@open-mercato/events 0.10.1-develop.7579.1.3db6f78f16 → 0.10.1-develop.7581.1.b3eee6e717

package/AGENTS.md

@@ -205,4 +205,4 @@ Every emit of a `clientBroadcast: true` event costs a serialized `pg_notify` rou
 
 ### Private cross-process coordination
 
-Use `crossProcessBroadcast: true` for server-to-server invalidation or coordination that must cross process boundaries but must not be exposed through browser SSE. The event bus publishes both `clientBroadcast` and `crossProcessBroadcast` events to the cross-process bridge, while the DOM Event Bridge delivers only `clientBroadcast` events. Do not use `clientBroadcast` merely to reach another server process when the payload contains record-scoped identifiers or activity that the organization-level SSE audience cannot authorize.
+Use `crossProcessBroadcast: true` for server-to-server invalidation or coordination that must cross process boundaries but must not be exposed through browser SSE. The event bus publishes `clientBroadcast`, `portalBroadcast` and `crossProcessBroadcast` events to the cross-process bridge (only with trusted tenant scope), while the DOM Event Bridge delivers only `clientBroadcast` events and the portal stream only `portalBroadcast` events — each consumer filters by its own flag and skips its own echo via `CROSS_PROCESS_EVENT_INSTANCE_ID` (never `originPid`). An envelope over the 7 KB `pg_notify` cap is truncated to `{ truncated: true, id/entityId/entityType }` plus its audience-scope fields (consumers re-fetch); private `crossProcessBroadcast` envelopes are never reshaped and are dropped when oversize. Do not use `clientBroadcast` merely to reach another server process when the payload contains record-scoped identifiers or activity that the organization-level SSE audience cannot authorize.

package/dist/bridge.js

@@ -2,9 +2,13 @@ import { randomUUID } from "node:crypto";
 import { Client, Pool } from "pg";
 import { getSslConfig } from "@open-mercato/shared/lib/db/ssl";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { isPrivateCrossProcessBroadcastEvent } from "@open-mercato/shared/modules/events";
 const BRIDGE_CHANNEL = "om_event_bridge";
 const MAX_MESSAGE_BYTES = 7e3;
 const RECONNECT_DELAY_MS = 1e3;
+const TRUNCATED_ENTITY_REF_KEYS = ["id", "entityId", "entityType"];
+const TRUNCATED_AUDIENCE_SCALAR_KEYS = ["tenantId", "organizationId", "recipientUserId", "recipientRoleId"];
+const TRUNCATED_AUDIENCE_LIST_KEYS = ["organizationIds", "recipientUserIds", "recipientRoleIds"];
 const CROSS_PROCESS_EVENT_INSTANCE_ID_KEY = "__openMercatoCrossProcessEventInstanceId__";
 const logger = createLogger("events");
 function getCrossProcessEventInstanceId() {
@@ -136,13 +140,43 @@ async function publishCrossProcessEvent(event, payload, options) {
     originPid: process.pid,
     originInstanceId: CROSS_PROCESS_EVENT_INSTANCE_ID
   };
-  const serialized = JSON.stringify(envelope);
-  if (Buffer.byteLength(serialized, "utf8") > MAX_MESSAGE_BYTES) {
+  const serialized = serializeWithinLimit(envelope);
+  if (!serialized) {
     logger.warn("Cross-process event dropped: payload exceeds size limit", { event, maxBytes: MAX_MESSAGE_BYTES });
     return;
   }
   await pool.query("SELECT pg_notify($1, $2)", [BRIDGE_CHANNEL, serialized]);
 }
+function fitsMessageLimit(serialized) {
+  return Buffer.byteLength(serialized, "utf8") <= MAX_MESSAGE_BYTES;
+}
+function serializeWithinLimit(envelope) {
+  const serialized = JSON.stringify(envelope);
+  if (fitsMessageLimit(serialized)) return serialized;
+  if (isPrivateCrossProcessBroadcastEvent(envelope.event)) return null;
+  const truncated = JSON.stringify({ ...envelope, payload: buildTruncatedPayload(envelope.payload) });
+  if (!fitsMessageLimit(truncated)) return null;
+  logger.warn("Cross-process event truncated: payload exceeds size limit", {
+    event: envelope.event,
+    maxBytes: MAX_MESSAGE_BYTES
+  });
+  return truncated;
+}
+function buildTruncatedPayload(payload) {
+  const source = payload ?? {};
+  const truncated = { truncated: true };
+  for (const key of [...TRUNCATED_ENTITY_REF_KEYS, ...TRUNCATED_AUDIENCE_SCALAR_KEYS]) {
+    const value = source[key];
+    if (typeof value === "string" && value.trim().length > 0) truncated[key] = value.trim();
+  }
+  for (const key of TRUNCATED_AUDIENCE_LIST_KEYS) {
+    const value = source[key];
+    if (!Array.isArray(value)) continue;
+    const scopes = value.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (scopes.length > 0) truncated[key] = scopes;
+  }
+  return truncated;
+}
 function registerCrossProcessEventListener(listener) {
   listeners.add(listener);
   void ensureCrossProcessListener();

package/dist/bridge.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bridge.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { Client, Pool } from 'pg'\nimport { getSslConfig } from '@open-mercato/shared/lib/db/ssl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { EmitOptions, EventPayload } from './types'\n\nconst BRIDGE_CHANNEL = 'om_event_bridge'\nconst MAX_MESSAGE_BYTES = 7_000\nconst RECONNECT_DELAY_MS = 1_000\nconst CROSS_PROCESS_EVENT_INSTANCE_ID_KEY = '__openMercatoCrossProcessEventInstanceId__'\n\nconst logger = createLogger('events')\n\n/**\n * PIDs can collide across containers, so self-echo suppression must not rely\n * on originPid alone. Every publisher stamps envelopes with this random\n * per-process instance id; consumers prefer it and fall back to originPid\n * only for envelopes published by older processes during a rolling deploy.\n */\nfunction getCrossProcessEventInstanceId(): string {\n  const globalScope = globalThis as Record<string, unknown>\n  const existing = globalScope[CROSS_PROCESS_EVENT_INSTANCE_ID_KEY]\n  if (typeof existing === 'string' && existing.length > 0) return existing\n  const created = randomUUID()\n  globalScope[CROSS_PROCESS_EVENT_INSTANCE_ID_KEY] = created\n  return created\n}\n\nexport const CROSS_PROCESS_EVENT_INSTANCE_ID = getCrossProcessEventInstanceId()\n\ntype BridgeEnvelope = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  originPid: number\n  originInstanceId?: string\n}\n\ntype CrossProcessEventListener = (envelope: BridgeEnvelope) => void | Promise<void>\ntype PgNotificationMessage = {\n  channel: string\n  payload?: string\n}\n\nlet publisherPool: InstanceType<typeof Pool> | null | undefined\nlet listenerClient: InstanceType<typeof Client> | null = null\nlet listenerConnectPromise: Promise<void> | null = null\nlet listenerReconnectTimer: ReturnType<typeof setTimeout> | null = null\nconst listeners = new Set<CrossProcessEventListener>()\n\nfunction getDatabaseUrl(): string | null {\n  const value = process.env.DATABASE_URL?.trim()\n  return value && value.length > 0 ? value : null\n}\n\nfunction getPgBridgeConnectionString(): string | null {\n  const connectionString = getDatabaseUrl()\n  if (!connectionString) return null\n\n  try {\n    const url = new URL(connectionString)\n    for (const key of ['sslmode', 'sslcert', 'sslkey', 'sslrootcert', 'sslcrl']) {\n      url.searchParams.delete(key)\n    }\n    return url.toString()\n  } catch {\n    return connectionString\n  }\n}\n\nfunction getPublisherPool(): InstanceType<typeof Pool> | null {\n  if (publisherPool !== undefined) return publisherPool\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) {\n    publisherPool = null\n    return null\n  }\n  const ssl = getSslConfig()\n  publisherPool = new Pool({\n    connectionString,\n    max: 2,\n    ...(ssl ? { ssl } : {}),\n  })\n  return publisherPool\n}\n\nasync function dispatchEnvelope(envelope: BridgeEnvelope): Promise<void> {\n  for (const listener of listeners) {\n    try {\n      await Promise.resolve(listener(envelope))\n    } catch (error) {\n      logger.error('Cross-process listener error', { event: envelope.event, err: error })\n    }\n  }\n}\n\nfunction clearReconnectTimer(): void {\n  if (!listenerReconnectTimer) return\n  clearTimeout(listenerReconnectTimer)\n  listenerReconnectTimer = null\n}\n\nasync function closeListenerClient(): Promise<void> {\n  if (!listenerClient) return\n  const client = listenerClient\n  listenerClient = null\n  try {\n    client.removeAllListeners('notification')\n    client.removeAllListeners('error')\n    client.removeAllListeners('end')\n    await client.end()\n  } catch {\n    // Ignore shutdown errors.\n  }\n}\n\nfunction scheduleReconnect(): void {\n  if (listenerReconnectTimer || listeners.size === 0) return\n  listenerReconnectTimer = setTimeout(() => {\n    listenerReconnectTimer = null\n    void ensureCrossProcessListener()\n  }, RECONNECT_DELAY_MS)\n}\n\nasync function ensureCrossProcessListener(): Promise<void> {\n  if (listenerClient || listenerConnectPromise || listeners.size === 0) return\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) return\n\n  listenerConnectPromise = (async () => {\n    const ssl = getSslConfig()\n    const client = new Client({\n      connectionString,\n      ...(ssl ? { ssl } : {}),\n    })\n\n    client.on('notification', (message: PgNotificationMessage) => {\n      if (message.channel !== BRIDGE_CHANNEL || !message.payload) return\n      try {\n        const parsed = JSON.parse(message.payload) as BridgeEnvelope\n        if (!parsed || typeof parsed.event !== 'string') return\n        void dispatchEnvelope(parsed)\n      } catch (error) {\n        logger.warn('Failed to parse cross-process bridge payload', { err: error })\n      }\n    })\n\n    const handleDisconnect = () => {\n      if (listenerClient === client) {\n        listenerClient = null\n      }\n      scheduleReconnect()\n    }\n\n    client.on('error', handleDisconnect)\n    client.on('end', handleDisconnect)\n\n    await client.connect()\n    await client.query(`LISTEN ${BRIDGE_CHANNEL}`)\n    listenerClient = client\n  })()\n    .catch((error) => {\n      logger.warn('Cross-process event bridge listener failed', { err: error })\n      scheduleReconnect()\n    })\n    .finally(() => {\n      listenerConnectPromise = null\n    })\n\n  await listenerConnectPromise\n}\n\nexport async function publishCrossProcessEvent(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): Promise<void> {\n  const pool = getPublisherPool()\n  if (!pool) return\n\n  const bridgeOptions = options\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n    && options.tenantId === undefined\n    ? { ...options, tenantId: null }\n    : options\n\n  const envelope: BridgeEnvelope = {\n    event,\n    payload,\n    options: bridgeOptions,\n    originPid: process.pid,\n    originInstanceId: CROSS_PROCESS_EVENT_INSTANCE_ID,\n  }\n\n  const serialized = JSON.stringify(envelope)\n  if (Buffer.byteLength(serialized, 'utf8') > MAX_MESSAGE_BYTES) {\n    logger.warn('Cross-process event dropped: payload exceeds size limit', { event, maxBytes: MAX_MESSAGE_BYTES })\n    return\n  }\n\n  await pool.query('SELECT pg_notify($1, $2)', [BRIDGE_CHANNEL, serialized])\n}\n\nexport function registerCrossProcessEventListener(listener: CrossProcessEventListener): () => void {\n  listeners.add(listener)\n  void ensureCrossProcessListener()\n\n  return () => {\n    listeners.delete(listener)\n    if (listeners.size === 0) {\n      clearReconnectTimer()\n      void closeListenerClient()\n    }\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAG7B,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,sCAAsC;AAE5C,MAAM,SAAS,aAAa,QAAQ;AAQpC,SAAS,iCAAyC;AAChD,QAAM,cAAc;AACpB,QAAM,WAAW,YAAY,mCAAmC;AAChE,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,QAAM,UAAU,WAAW;AAC3B,cAAY,mCAAmC,IAAI;AACnD,SAAO;AACT;AAEO,MAAM,kCAAkC,+BAA+B;AAgB9E,IAAI;AACJ,IAAI,iBAAqD;AACzD,IAAI,yBAA+C;AACnD,IAAI,yBAA+D;AACnE,MAAM,YAAY,oBAAI,IAA+B;AAErD,SAAS,iBAAgC;AACvC,QAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC7C,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,8BAA6C;AACpD,QAAM,mBAAmB,eAAe;AACxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,gBAAgB;AACpC,eAAW,OAAO,CAAC,WAAW,WAAW,UAAU,eAAe,QAAQ,GAAG;AAC3E,UAAI,aAAa,OAAO,GAAG;AAAA,IAC7B;AACA,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAqD;AAC5D,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,kBAAkB;AACrB,oBAAgB;AAChB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa;AACzB,kBAAgB,IAAI,KAAK;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,iBAAiB,UAAyC;AACvE,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,YAAM,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,gCAAgC,EAAE,OAAO,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAEA,SAAS,sBAA4B;AACnC,MAAI,CAAC,uBAAwB;AAC7B,eAAa,sBAAsB;AACnC,2BAAyB;AAC3B;AAEA,eAAe,sBAAqC;AAClD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS;AACf,mBAAiB;AACjB,MAAI;AACF,WAAO,mBAAmB,cAAc;AACxC,WAAO,mBAAmB,OAAO;AACjC,WAAO,mBAAmB,KAAK;AAC/B,UAAM,OAAO,IAAI;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,0BAA0B,UAAU,SAAS,EAAG;AACpD,2BAAyB,WAAW,MAAM;AACxC,6BAAyB;AACzB,SAAK,2BAA2B;AAAA,EAClC,GAAG,kBAAkB;AACvB;AAEA,eAAe,6BAA4C;AACzD,MAAI,kBAAkB,0BAA0B,UAAU,SAAS,EAAG;AACtE,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,iBAAkB;AAEvB,4BAA0B,YAAY;AACpC,UAAM,MAAM,aAAa;AACzB,UAAM,SAAS,IAAI,OAAO;AAAA,MACxB;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAED,WAAO,GAAG,gBAAgB,CAAC,YAAmC;AAC5D,UAAI,QAAQ,YAAY,kBAAkB,CAAC,QAAQ,QAAS;AAC5D,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,QAAQ,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,OAAO,UAAU,SAAU;AACjD,aAAK,iBAAiB,MAAM;AAAA,MAC9B,SAAS,OAAO;AACd,eAAO,KAAK,gDAAgD,EAAE,KAAK,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,MAAM;AAC7B,UAAI,mBAAmB,QAAQ;AAC7B,yBAAiB;AAAA,MACnB;AACA,wBAAkB;AAAA,IACpB;AAEA,WAAO,GAAG,SAAS,gBAAgB;AACnC,WAAO,GAAG,OAAO,gBAAgB;AAEjC,UAAM,OAAO,QAAQ;AACrB,UAAM,OAAO,MAAM,UAAU,cAAc,EAAE;AAC7C,qBAAiB;AAAA,EACnB,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAO,KAAK,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACxE,sBAAkB;AAAA,EACpB,CAAC,EACA,QAAQ,MAAM;AACb,6BAAyB;AAAA,EAC3B,CAAC;AAEH,QAAM;AACR;AAEA,eAAsB,yBACpB,OACA,SACA,SACe;AACf,QAAM,OAAO,iBAAiB;AAC9B,MAAI,CAAC,KAAM;AAEX,QAAM,gBAAgB,WACjB,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU,KACxD,QAAQ,aAAa,SACtB,EAAE,GAAG,SAAS,UAAU,KAAK,IAC7B;AAEJ,QAAM,WAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,IACnB,kBAAkB;AAAA,EACpB;AAEA,QAAM,aAAa,KAAK,UAAU,QAAQ;AAC1C,MAAI,OAAO,WAAW,YAAY,MAAM,IAAI,mBAAmB;AAC7D,WAAO,KAAK,2DAA2D,EAAE,OAAO,UAAU,kBAAkB,CAAC;AAC7G;AAAA,EACF;AAEA,QAAM,KAAK,MAAM,4BAA4B,CAAC,gBAAgB,UAAU,CAAC;AAC3E;AAEO,SAAS,kCAAkC,UAAiD;AACjG,YAAU,IAAI,QAAQ;AACtB,OAAK,2BAA2B;AAEhC,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,0BAAoB;AACpB,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { Client, Pool } from 'pg'\nimport { getSslConfig } from '@open-mercato/shared/lib/db/ssl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport type { EmitOptions, EventPayload } from './types'\n\nconst BRIDGE_CHANNEL = 'om_event_bridge'\nconst MAX_MESSAGE_BYTES = 7_000\nconst RECONNECT_DELAY_MS = 1_000\nconst TRUNCATED_ENTITY_REF_KEYS = ['id', 'entityId', 'entityType'] as const\nconst TRUNCATED_AUDIENCE_SCALAR_KEYS = ['tenantId', 'organizationId', 'recipientUserId', 'recipientRoleId'] as const\nconst TRUNCATED_AUDIENCE_LIST_KEYS = ['organizationIds', 'recipientUserIds', 'recipientRoleIds'] as const\nconst CROSS_PROCESS_EVENT_INSTANCE_ID_KEY = '__openMercatoCrossProcessEventInstanceId__'\n\nconst logger = createLogger('events')\n\n/**\n * PIDs can collide across containers, so self-echo suppression must not rely\n * on originPid alone. Every publisher stamps envelopes with this random\n * per-process instance id; consumers prefer it and fall back to originPid\n * only for envelopes published by older processes during a rolling deploy.\n */\nfunction getCrossProcessEventInstanceId(): string {\n  const globalScope = globalThis as Record<string, unknown>\n  const existing = globalScope[CROSS_PROCESS_EVENT_INSTANCE_ID_KEY]\n  if (typeof existing === 'string' && existing.length > 0) return existing\n  const created = randomUUID()\n  globalScope[CROSS_PROCESS_EVENT_INSTANCE_ID_KEY] = created\n  return created\n}\n\nexport const CROSS_PROCESS_EVENT_INSTANCE_ID = getCrossProcessEventInstanceId()\n\ntype BridgeEnvelope = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  originPid: number\n  originInstanceId?: string\n}\n\ntype CrossProcessEventListener = (envelope: BridgeEnvelope) => void | Promise<void>\ntype PgNotificationMessage = {\n  channel: string\n  payload?: string\n}\n\nlet publisherPool: InstanceType<typeof Pool> | null | undefined\nlet listenerClient: InstanceType<typeof Client> | null = null\nlet listenerConnectPromise: Promise<void> | null = null\nlet listenerReconnectTimer: ReturnType<typeof setTimeout> | null = null\nconst listeners = new Set<CrossProcessEventListener>()\n\nfunction getDatabaseUrl(): string | null {\n  const value = process.env.DATABASE_URL?.trim()\n  return value && value.length > 0 ? value : null\n}\n\nfunction getPgBridgeConnectionString(): string | null {\n  const connectionString = getDatabaseUrl()\n  if (!connectionString) return null\n\n  try {\n    const url = new URL(connectionString)\n    for (const key of ['sslmode', 'sslcert', 'sslkey', 'sslrootcert', 'sslcrl']) {\n      url.searchParams.delete(key)\n    }\n    return url.toString()\n  } catch {\n    return connectionString\n  }\n}\n\nfunction getPublisherPool(): InstanceType<typeof Pool> | null {\n  if (publisherPool !== undefined) return publisherPool\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) {\n    publisherPool = null\n    return null\n  }\n  const ssl = getSslConfig()\n  publisherPool = new Pool({\n    connectionString,\n    max: 2,\n    ...(ssl ? { ssl } : {}),\n  })\n  return publisherPool\n}\n\nasync function dispatchEnvelope(envelope: BridgeEnvelope): Promise<void> {\n  for (const listener of listeners) {\n    try {\n      await Promise.resolve(listener(envelope))\n    } catch (error) {\n      logger.error('Cross-process listener error', { event: envelope.event, err: error })\n    }\n  }\n}\n\nfunction clearReconnectTimer(): void {\n  if (!listenerReconnectTimer) return\n  clearTimeout(listenerReconnectTimer)\n  listenerReconnectTimer = null\n}\n\nasync function closeListenerClient(): Promise<void> {\n  if (!listenerClient) return\n  const client = listenerClient\n  listenerClient = null\n  try {\n    client.removeAllListeners('notification')\n    client.removeAllListeners('error')\n    client.removeAllListeners('end')\n    await client.end()\n  } catch {\n    // Ignore shutdown errors.\n  }\n}\n\nfunction scheduleReconnect(): void {\n  if (listenerReconnectTimer || listeners.size === 0) return\n  listenerReconnectTimer = setTimeout(() => {\n    listenerReconnectTimer = null\n    void ensureCrossProcessListener()\n  }, RECONNECT_DELAY_MS)\n}\n\nasync function ensureCrossProcessListener(): Promise<void> {\n  if (listenerClient || listenerConnectPromise || listeners.size === 0) return\n  const connectionString = getPgBridgeConnectionString()\n  if (!connectionString) return\n\n  listenerConnectPromise = (async () => {\n    const ssl = getSslConfig()\n    const client = new Client({\n      connectionString,\n      ...(ssl ? { ssl } : {}),\n    })\n\n    client.on('notification', (message: PgNotificationMessage) => {\n      if (message.channel !== BRIDGE_CHANNEL || !message.payload) return\n      try {\n        const parsed = JSON.parse(message.payload) as BridgeEnvelope\n        if (!parsed || typeof parsed.event !== 'string') return\n        void dispatchEnvelope(parsed)\n      } catch (error) {\n        logger.warn('Failed to parse cross-process bridge payload', { err: error })\n      }\n    })\n\n    const handleDisconnect = () => {\n      if (listenerClient === client) {\n        listenerClient = null\n      }\n      scheduleReconnect()\n    }\n\n    client.on('error', handleDisconnect)\n    client.on('end', handleDisconnect)\n\n    await client.connect()\n    await client.query(`LISTEN ${BRIDGE_CHANNEL}`)\n    listenerClient = client\n  })()\n    .catch((error) => {\n      logger.warn('Cross-process event bridge listener failed', { err: error })\n      scheduleReconnect()\n    })\n    .finally(() => {\n      listenerConnectPromise = null\n    })\n\n  await listenerConnectPromise\n}\n\nexport async function publishCrossProcessEvent(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): Promise<void> {\n  const pool = getPublisherPool()\n  if (!pool) return\n\n  const bridgeOptions = options\n    && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n    && options.tenantId === undefined\n    ? { ...options, tenantId: null }\n    : options\n\n  const envelope: BridgeEnvelope = {\n    event,\n    payload,\n    options: bridgeOptions,\n    originPid: process.pid,\n    originInstanceId: CROSS_PROCESS_EVENT_INSTANCE_ID,\n  }\n\n  const serialized = serializeWithinLimit(envelope)\n  if (!serialized) {\n    logger.warn('Cross-process event dropped: payload exceeds size limit', { event, maxBytes: MAX_MESSAGE_BYTES })\n    return\n  }\n\n  await pool.query('SELECT pg_notify($1, $2)', [BRIDGE_CHANNEL, serialized])\n}\n\nfunction fitsMessageLimit(serialized: string): boolean {\n  return Buffer.byteLength(serialized, 'utf8') <= MAX_MESSAGE_BYTES\n}\n\n/** Oversize browser-facing envelopes degrade to a scoped entity ref; private coordination is never reshaped, only dropped. */\nfunction serializeWithinLimit(envelope: BridgeEnvelope): string | null {\n  const serialized = JSON.stringify(envelope)\n  if (fitsMessageLimit(serialized)) return serialized\n  if (isPrivateCrossProcessBroadcastEvent(envelope.event)) return null\n  const truncated = JSON.stringify({ ...envelope, payload: buildTruncatedPayload(envelope.payload) })\n  if (!fitsMessageLimit(truncated)) return null\n  logger.warn('Cross-process event truncated: payload exceeds size limit', {\n    event: envelope.event,\n    maxBytes: MAX_MESSAGE_BYTES,\n  })\n  return truncated\n}\n\nfunction buildTruncatedPayload(payload: EventPayload): EventPayload {\n  const source = (payload ?? {}) as Record<string, unknown>\n  const truncated: Record<string, unknown> = { truncated: true }\n  for (const key of [...TRUNCATED_ENTITY_REF_KEYS, ...TRUNCATED_AUDIENCE_SCALAR_KEYS]) {\n    const value = source[key]\n    if (typeof value === 'string' && value.trim().length > 0) truncated[key] = value.trim()\n  }\n  for (const key of TRUNCATED_AUDIENCE_LIST_KEYS) {\n    const value = source[key]\n    if (!Array.isArray(value)) continue\n    const scopes = value.filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0)\n    if (scopes.length > 0) truncated[key] = scopes\n  }\n  return truncated\n}\n\nexport function registerCrossProcessEventListener(listener: CrossProcessEventListener): () => void {\n  listeners.add(listener)\n  void ensureCrossProcessListener()\n\n  return () => {\n    listeners.delete(listener)\n    if (listeners.size === 0) {\n      clearReconnectTimer()\n      void closeListenerClient()\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AAGpD,MAAM,iBAAiB;AACvB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,4BAA4B,CAAC,MAAM,YAAY,YAAY;AACjE,MAAM,iCAAiC,CAAC,YAAY,kBAAkB,mBAAmB,iBAAiB;AAC1G,MAAM,+BAA+B,CAAC,mBAAmB,oBAAoB,kBAAkB;AAC/F,MAAM,sCAAsC;AAE5C,MAAM,SAAS,aAAa,QAAQ;AAQpC,SAAS,iCAAyC;AAChD,QAAM,cAAc;AACpB,QAAM,WAAW,YAAY,mCAAmC;AAChE,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,QAAM,UAAU,WAAW;AAC3B,cAAY,mCAAmC,IAAI;AACnD,SAAO;AACT;AAEO,MAAM,kCAAkC,+BAA+B;AAgB9E,IAAI;AACJ,IAAI,iBAAqD;AACzD,IAAI,yBAA+C;AACnD,IAAI,yBAA+D;AACnE,MAAM,YAAY,oBAAI,IAA+B;AAErD,SAAS,iBAAgC;AACvC,QAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC7C,SAAO,SAAS,MAAM,SAAS,IAAI,QAAQ;AAC7C;AAEA,SAAS,8BAA6C;AACpD,QAAM,mBAAmB,eAAe;AACxC,MAAI,CAAC,iBAAkB,QAAO;AAE9B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,gBAAgB;AACpC,eAAW,OAAO,CAAC,WAAW,WAAW,UAAU,eAAe,QAAQ,GAAG;AAC3E,UAAI,aAAa,OAAO,GAAG;AAAA,IAC7B;AACA,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAqD;AAC5D,MAAI,kBAAkB,OAAW,QAAO;AACxC,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,kBAAkB;AACrB,oBAAgB;AAChB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa;AACzB,kBAAgB,IAAI,KAAK;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACD,SAAO;AACT;AAEA,eAAe,iBAAiB,UAAyC;AACvE,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,YAAM,QAAQ,QAAQ,SAAS,QAAQ,CAAC;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,MAAM,gCAAgC,EAAE,OAAO,SAAS,OAAO,KAAK,MAAM,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAEA,SAAS,sBAA4B;AACnC,MAAI,CAAC,uBAAwB;AAC7B,eAAa,sBAAsB;AACnC,2BAAyB;AAC3B;AAEA,eAAe,sBAAqC;AAClD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS;AACf,mBAAiB;AACjB,MAAI;AACF,WAAO,mBAAmB,cAAc;AACxC,WAAO,mBAAmB,OAAO;AACjC,WAAO,mBAAmB,KAAK;AAC/B,UAAM,OAAO,IAAI;AAAA,EACnB,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,oBAA0B;AACjC,MAAI,0BAA0B,UAAU,SAAS,EAAG;AACpD,2BAAyB,WAAW,MAAM;AACxC,6BAAyB;AACzB,SAAK,2BAA2B;AAAA,EAClC,GAAG,kBAAkB;AACvB;AAEA,eAAe,6BAA4C;AACzD,MAAI,kBAAkB,0BAA0B,UAAU,SAAS,EAAG;AACtE,QAAM,mBAAmB,4BAA4B;AACrD,MAAI,CAAC,iBAAkB;AAEvB,4BAA0B,YAAY;AACpC,UAAM,MAAM,aAAa;AACzB,UAAM,SAAS,IAAI,OAAO;AAAA,MACxB;AAAA,MACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,IACvB,CAAC;AAED,WAAO,GAAG,gBAAgB,CAAC,YAAmC;AAC5D,UAAI,QAAQ,YAAY,kBAAkB,CAAC,QAAQ,QAAS;AAC5D,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,QAAQ,OAAO;AACzC,YAAI,CAAC,UAAU,OAAO,OAAO,UAAU,SAAU;AACjD,aAAK,iBAAiB,MAAM;AAAA,MAC9B,SAAS,OAAO;AACd,eAAO,KAAK,gDAAgD,EAAE,KAAK,MAAM,CAAC;AAAA,MAC5E;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,MAAM;AAC7B,UAAI,mBAAmB,QAAQ;AAC7B,yBAAiB;AAAA,MACnB;AACA,wBAAkB;AAAA,IACpB;AAEA,WAAO,GAAG,SAAS,gBAAgB;AACnC,WAAO,GAAG,OAAO,gBAAgB;AAEjC,UAAM,OAAO,QAAQ;AACrB,UAAM,OAAO,MAAM,UAAU,cAAc,EAAE;AAC7C,qBAAiB;AAAA,EACnB,GAAG,EACA,MAAM,CAAC,UAAU;AAChB,WAAO,KAAK,8CAA8C,EAAE,KAAK,MAAM,CAAC;AACxE,sBAAkB;AAAA,EACpB,CAAC,EACA,QAAQ,MAAM;AACb,6BAAyB;AAAA,EAC3B,CAAC;AAEH,QAAM;AACR;AAEA,eAAsB,yBACpB,OACA,SACA,SACe;AACf,QAAM,OAAO,iBAAiB;AAC9B,MAAI,CAAC,KAAM;AAEX,QAAM,gBAAgB,WACjB,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU,KACxD,QAAQ,aAAa,SACtB,EAAE,GAAG,SAAS,UAAU,KAAK,IAC7B;AAEJ,QAAM,WAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,IACnB,kBAAkB;AAAA,EACpB;AAEA,QAAM,aAAa,qBAAqB,QAAQ;AAChD,MAAI,CAAC,YAAY;AACf,WAAO,KAAK,2DAA2D,EAAE,OAAO,UAAU,kBAAkB,CAAC;AAC7G;AAAA,EACF;AAEA,QAAM,KAAK,MAAM,4BAA4B,CAAC,gBAAgB,UAAU,CAAC;AAC3E;AAEA,SAAS,iBAAiB,YAA6B;AACrD,SAAO,OAAO,WAAW,YAAY,MAAM,KAAK;AAClD;AAGA,SAAS,qBAAqB,UAAyC;AACrE,QAAM,aAAa,KAAK,UAAU,QAAQ;AAC1C,MAAI,iBAAiB,UAAU,EAAG,QAAO;AACzC,MAAI,oCAAoC,SAAS,KAAK,EAAG,QAAO;AAChE,QAAM,YAAY,KAAK,UAAU,EAAE,GAAG,UAAU,SAAS,sBAAsB,SAAS,OAAO,EAAE,CAAC;AAClG,MAAI,CAAC,iBAAiB,SAAS,EAAG,QAAO;AACzC,SAAO,KAAK,6DAA6D;AAAA,IACvE,OAAO,SAAS;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AACT;AAEA,SAAS,sBAAsB,SAAqC;AAClE,QAAM,SAAU,WAAW,CAAC;AAC5B,QAAM,YAAqC,EAAE,WAAW,KAAK;AAC7D,aAAW,OAAO,CAAC,GAAG,2BAA2B,GAAG,8BAA8B,GAAG;AACnF,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,WAAU,GAAG,IAAI,MAAM,KAAK;AAAA,EACxF;AACA,aAAW,OAAO,8BAA8B;AAC9C,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG;AAC3B,UAAM,SAAS,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAC5G,QAAI,OAAO,SAAS,EAAG,WAAU,GAAG,IAAI;AAAA,EAC1C;AACA,SAAO;AACT;AAEO,SAAS,kCAAkC,UAAiD;AACjG,YAAU,IAAI,QAAQ;AACtB,OAAK,2BAA2B;AAEhC,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AACzB,QAAI,UAAU,SAAS,GAAG;AACxB,0BAAoB;AACpB,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/bus.js

@@ -8,6 +8,8 @@ import {
   isBroadcastEvent,
   isCoalescedBroadcastEvent,
   isCrossProcessBroadcastEvent,
+  isPortalBroadcastEvent,
+  isPrivateCrossProcessBroadcastEvent,
   isPrivateCrossProcessEventEmitter
 } from "@open-mercato/shared/modules/events";
 import {
@@ -34,9 +36,15 @@ function hasTrustedTenantScope(options) {
 function normalizePayloadScope(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
+function isBrowserBroadcastEvent(event) {
+  return isBroadcastEvent(event) || isPortalBroadcastEvent(event);
+}
+function shouldPublishCrossProcess(event) {
+  return isCrossProcessBroadcastEvent(event) || isPortalBroadcastEvent(event);
+}
 function resolveCrossProcessEmitOptions(event, payload, options) {
   if (hasTrustedTenantScope(options)) return options;
-  if (!isBroadcastEvent(event)) return options;
+  if (!isBrowserBroadcastEvent(event) || isPrivateCrossProcessBroadcastEvent(event)) return options;
   const tenantId = normalizePayloadScope(payload?.tenantId);
   if (!tenantId) return options;
   const organizationId = normalizePayloadScope(payload?.organizationId);
@@ -305,7 +313,7 @@ function createEventBus(opts) {
     };
     const publishToOtherProcesses = async () => {
       const crossProcessOptions = resolveCrossProcessEmitOptions(event, payload, options);
-      if (!isCrossProcessBroadcastEvent(event) || !hasTrustedTenantScope(crossProcessOptions) || !isPrivateCrossProcessEventEmitter(event, crossProcessOptions?.emitterModuleId)) return;
+      if (!shouldPublishCrossProcess(event) || !hasTrustedTenantScope(crossProcessOptions) || !isPrivateCrossProcessEventEmitter(event, crossProcessOptions?.emitterModuleId)) return;
       try {
         await publishCrossProcessEvent(event, payload, crossProcessOptions);
       } catch (error) {

package/dist/bus.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bus.ts"],
-  "sourcesContent": ["import { createQueue } from '@open-mercato/queue'\nimport type { Queue } from '@open-mercato/queue'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isSingleDeliveryRequested } from './single-delivery'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport {\n  isBroadcastEvent,\n  isCoalescedBroadcastEvent,\n  isCrossProcessBroadcastEvent,\n  isPrivateCrossProcessEventEmitter,\n} from '@open-mercato/shared/modules/events'\nimport {\n  BROADCAST_FLUSH_DEADLINE_MS,\n  flushPendingBroadcasts,\n  resolveBroadcastCoalesceIntervalMs,\n  submitBroadcast,\n} from './broadcast-coalescer'\nimport {\n  inferModuleIdFromResourceId,\n  withModuleResourceUsage,\n} from '@open-mercato/shared/lib/modules/resource-usage'\nexport { registerCrossProcessEventListener, CROSS_PROCESS_EVENT_INSTANCE_ID } from './bridge'\nimport { publishCrossProcessEvent } from './bridge'\nimport type {\n  EventBus,\n  CreateBusOptions,\n  SubscriberHandler,\n  SubscriberDescriptor,\n  EventPayload,\n  EmitOptions,\n  QueuedDispatchResult,\n} from './types'\n\n/** Queue name for persistent events */\nconst EVENTS_QUEUE_NAME = 'events'\n\nconst logger = createLogger('events')\n\ntype RegisteredSubscriber = {\n  id?: string\n  moduleId?: string\n  event: string\n  handler: SubscriberHandler\n  persistent?: boolean\n}\n\n/**\n * When enabled, a persistent emit delivers each subscriber on exactly one path:\n * persistent-marked subscribers are skipped inline (the events worker dispatches\n * them via pattern match, so wildcard persistent subscribers are reached), while\n * ephemeral subscribers keep running inline. Defaults ON.\n *\n * The bus never second-guesses this against \"is a worker running\": the queue is\n * durable, so a persistent emit with no worker yet is delayed, not lost, and a\n * worker started later drains the backlog. Delivering inline instead would move\n * the work back onto the caller's request path \u2014 exactly what a split app/worker\n * deployment sets `AUTO_SPAWN_WORKERS=false` to avoid.\n *\n * The events worker asks this same bus for its subscribers via `dispatchQueued`,\n * so both halves of single-delivery read one decision.\n */\nfunction isSingleDeliveryEnabled(): boolean {\n  return isSingleDeliveryRequested()\n}\n\ntype GlobalEventTap = (event: string, payload: EventPayload, options?: EmitOptions) => void | Promise<void>\nconst GLOBAL_EVENT_TAPS_KEY = '__openMercatoEventBusGlobalTaps__'\n\nfunction hasTrustedTenantScope(options?: EmitOptions): boolean {\n  return typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n}\n\nfunction normalizePayloadScope(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction resolveCrossProcessEmitOptions(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): EmitOptions | undefined {\n  if (hasTrustedTenantScope(options)) return options\n  // Preserve the public raw EventBus contract for legacy clientBroadcast\n  // emitters. These callers are trusted server code and historically supplied\n  // their scope in the typed payload. Tenant-managed workflow execution passes\n  // scope in options, while private cross-process events never take this path.\n  if (!isBroadcastEvent(event)) return options\n  const tenantId = normalizePayloadScope((payload as Record<string, unknown>)?.tenantId)\n  if (!tenantId) return options\n  const organizationId = normalizePayloadScope((payload as Record<string, unknown>)?.organizationId)\n  const organizationIdsValue = (payload as Record<string, unknown>)?.organizationIds\n  const organizationIds = Array.isArray(organizationIdsValue)\n    ? organizationIdsValue.filter((value): value is string => typeof value === 'string')\n    : []\n  return {\n    ...options,\n    tenantId,\n    ...(organizationId ? { organizationId } : {}),\n    ...(organizationIds.length > 0 ? { organizationIds } : {}),\n  }\n}\n\nfunction collectStringScopes(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\n// Sorted so an audience keys identically however the caller ordered it, and\n// explicitly comparator-ed per the #3620 guard.\nfunction sortScopes(scopes: Set<string>): string[] {\n  return Array.from(scopes).sort((left, right) => left.localeCompare(right))\n}\n\n/**\n * Coalescing key for the browser dispatch of one event.\n *\n * Built from the raw union of every dimension the SSE audience filter\n * (`matchesAudience` in `events/api/stream/route.ts`) reads \u2014 tenant,\n * organization, recipient user and recipient role \u2014 taken from BOTH the\n * trusted `options` and the payload, without calling `resolveCrossProcessEmitOptions`\n * or any other resolver. Those resolvers pick one source to trust for delivery\n * semantics; the key instead has to key on every dimension a connection can be\n * filtered by, or one audience's emit would silently replace another\n * audience's pending delivery \u2014 recipient/role targeting and a portal-only\n * event (which carries no trusted `options` scope at all) included.\n *\n * Options and payload scope stay in separate segments, never merged: the three\n * filters each read a different source, so `options` org A + payload org B must\n * not key like the reverse. The options tenant segment encodes PRESENCE, not\n * just value \u2014 the backoffice `hasTrustedScope` is a presence test, so `{}` and\n * `{ tenantId: undefined }` take different filter branches and must not share\n * a key.\n *\n * Scope is part of the key by necessity, not for granularity: a key with no\n * scope segments would let a burst in one tenant suppress another tenant's\n * delivery and then deliver the first tenant's payload in its place.\n */\nfunction buildBroadcastCoalesceKey(event: string, payload: EventPayload, options?: EmitOptions): string {\n  const data = (payload ?? {}) as Record<string, unknown>\n\n  const payloadTenantId = normalizePayloadScope(data.tenantId) ?? ''\n  const optionsTenantToken = options && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n    ? `=${normalizePayloadScope(options.tenantId) ?? ''}`\n    : 'absent'\n\n  const optionsOrganizationScopes = new Set<string>()\n  const optionsOrganizationId = normalizePayloadScope(options?.organizationId)\n  if (optionsOrganizationId) optionsOrganizationScopes.add(optionsOrganizationId)\n  for (const organizationId of collectStringScopes(options?.organizationIds)) {\n    optionsOrganizationScopes.add(organizationId)\n  }\n\n  const payloadOrganizationScopes = new Set<string>()\n  const payloadOrganizationId = normalizePayloadScope(data.organizationId)\n  if (payloadOrganizationId) payloadOrganizationScopes.add(payloadOrganizationId)\n  for (const organizationId of collectStringScopes(data.organizationIds)) {\n    payloadOrganizationScopes.add(organizationId)\n  }\n\n  const recipientUserScopes = new Set<string>()\n  const recipientUserId = normalizePayloadScope(data.recipientUserId)\n  if (recipientUserId) recipientUserScopes.add(recipientUserId)\n  for (const userId of collectStringScopes(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  const recipientRoleId = normalizePayloadScope(data.recipientRoleId)\n  if (recipientRoleId) recipientRoleScopes.add(recipientRoleId)\n  for (const roleId of collectStringScopes(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return [\n    event,\n    payloadTenantId,\n    optionsTenantToken,\n    sortScopes(payloadOrganizationScopes).join(','),\n    sortScopes(optionsOrganizationScopes).join(','),\n    sortScopes(recipientUserScopes).join(','),\n    sortScopes(recipientRoleScopes).join(','),\n  ].join('::')\n}\n\nfunction getGlobalEventTaps(): Set<GlobalEventTap> {\n  const existing = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY]\n  if (existing instanceof Set) {\n    return existing as Set<GlobalEventTap>\n  }\n  const created = new Set<GlobalEventTap>()\n  ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY] = created\n  return created\n}\n\nexport function registerGlobalEventTap(handler: GlobalEventTap): () => void {\n  const taps = getGlobalEventTaps()\n  taps.add(handler)\n  return () => {\n    taps.delete(handler)\n  }\n}\n\n/** Job data structure for queued events */\ntype EventJobData = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  /**\n   * Set by the producer when it already ran the persistent subscribers inline\n   * (single-delivery reconciled off). The worker skips such jobs, so the app and\n   * the worker staying exactly-once no longer depends on both processes agreeing\n   * about `OM_EVENTS_SINGLE_DELIVERY`. Absent on jobs queued before this field\n   * existed, which keeps their behavior unchanged.\n   */\n  persistentDeliveredInline?: boolean\n}\n\n// Process-wide cache of the async (BullMQ) persistent-events producer queue.\n// Each authenticated request builds a fresh DI container and event bus, so a\n// per-bus producer queue opened a new ioredis connection per write request that\n// was never closed \u2014 leaking one Redis connection per request until maxclients\n// exhaustion. Memoizing the producer on `globalThis` (keyed by Redis URL, so a\n// reconfigured URL still gets its own queue) keeps it at one connection per\n// process, mirroring the `GLOBAL_EVENT_TAPS_KEY` and `getCachedRateLimiterService`\n// patterns. The local (file-based) strategy holds no pooled connection and its\n// base dir is cwd-relative, so it stays per-bus.\nconst EVENTS_PRODUCER_QUEUE_KEY = '__openMercatoEventsProducerQueues__'\nconst EVENTS_PRODUCER_SHUTDOWN_KEY = '__openMercatoEventsProducerShutdown__'\nconst BROADCAST_COALESCER_SHUTDOWN_KEY = '__openMercatoBroadcastCoalescerShutdown__'\n\nfunction isSharedProducerEnabled(): boolean {\n  return parseBooleanWithDefault(process.env.OM_EVENTS_SHARED_PRODUCER, true)\n}\n\nfunction getProducerQueueRegistry(): Map<string, Queue<EventJobData>> {\n  const existing = (globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Queue<EventJobData>>\n  }\n  const created = new Map<string, Queue<EventJobData>>()\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY] = created\n  return created\n}\n\nfunction registerProducerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY]) return\n  const shutdown = () => {\n    const registry = getProducerQueueRegistry()\n    for (const sharedQueue of registry.values()) {\n      Promise.resolve(sharedQueue.close()).catch(() => {})\n    }\n    registry.clear()\n  }\n  process.once('SIGTERM', shutdown)\n  process.once('SIGINT', shutdown)\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Deliver the tail of any in-flight coalesced burst on the way out, so stopping\n * a worker mid-import does not leave browsers a window behind. Registered\n * independently of the producer hook: coalescing is in play whether or not this\n * process ever opened an async producer queue.\n *\n * `beforeExit` matters as much as the signals here. The trailing timer is\n * unref'd so a pending browser delivery never holds a process open, which means\n * a short-lived emitter \u2014 a CLI import, a one-shot script \u2014 reaches a natural\n * exit with the tail still queued and no signal ever fired. `beforeExit` runs\n * exactly when the loop has drained, which is precisely that case.\n *\n * `createEventBus` calls this in every process that bootstraps DI \u2014 the app,\n * every worker, and every `mercato` CLI command \u2014 so a bare `process.once`\n * listener here would take away Node's default SIGINT/SIGTERM exit process-wide:\n * once ANY listener is registered for a signal, Node stops exiting on it, and\n * this listener only flushes, never exits. A one-shot CLI command (seed,\n * import, reindex) with no graceful-shutdown handler of its own would then\n * swallow the first Ctrl+C or SIGTERM and keep running until SIGKILL. The\n * per-signal handler below flushes, then restores the default behavior itself\n * \u2014 by re-raising the signal \u2014 but only when it was the last listener\n * (`once` already removed itself before this body runs): a process with its\n * own graceful-shutdown handler (the queue worker, `mercato server`) keeps\n * that handler in charge of the actual exit, and this hook just adds the flush\n * alongside it. Every flush here is capped at BROADCAST_FLUSH_DEADLINE_MS, so a\n * hung dispatch cannot hold a stop until SIGKILL.\n */\nfunction registerBroadcastCoalescerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[BROADCAST_COALESCER_SHUTDOWN_KEY]) return\n  const handleSignal = (signal: NodeJS.Signals) => {\n    void flushPendingBroadcasts({ deadlineMs: BROADCAST_FLUSH_DEADLINE_MS })\n      .catch(() => {})\n      .finally(() => {\n        if (process.listenerCount(signal) === 0) {\n          process.kill(process.pid, signal)\n        }\n      })\n  }\n  process.once('SIGTERM', () => handleSignal('SIGTERM'))\n  process.once('SIGINT', () => handleSignal('SIGINT'))\n  process.once('beforeExit', () => {\n    void flushPendingBroadcasts({ deadlineMs: BROADCAST_FLUSH_DEADLINE_MS }).catch(() => {})\n  })\n  ;(globalThis as Record<string, unknown>)[BROADCAST_COALESCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Creates an event bus instance.\n *\n * The event bus provides:\n * - In-memory event delivery to registered handlers\n * - Optional persistence via the queue package when `persistent: true`\n *\n * @param opts - Configuration options\n * @returns An EventBus instance\n *\n * @example\n * ```typescript\n * const bus = createEventBus({\n *   resolve: container.resolve.bind(container),\n *   queueStrategy: 'local', // or 'async' for BullMQ\n * })\n *\n * // Register a handler\n * bus.on('user.created', async (payload, ctx) => {\n *   const userService = ctx.resolve('userService')\n *   await userService.sendWelcomeEmail(payload.userId)\n * })\n *\n * // Emit an event (immediate delivery)\n * await bus.emit('user.created', { userId: '123' })\n *\n * // Emit with persistence (for async worker processing)\n * await bus.emit('order.placed', { orderId: '456' }, { persistent: true })\n * ```\n */\nexport function createEventBus(opts: CreateBusOptions): EventBus {\n  registerBroadcastCoalescerShutdownHook()\n\n  // In-memory listeners for immediate event delivery\n  const listeners = new Map<string, Set<RegisteredSubscriber>>()\n  // Subscribers registered as persistent (worker-dispatched). Used by the\n  // single-delivery path to skip them inline on a persistent emit.\n  const persistentSubscribers = new Set<RegisteredSubscriber>()\n\n  // Determine queue strategy from options or environment\n  const queueStrategy = opts.queueStrategy ??\n    (process.env.QUEUE_STRATEGY === 'async' ? 'async' : 'local')\n\n  // Lazy-initialized queue for persistent events\n  let queue: Queue<EventJobData> | null = null\n\n  /**\n   * Gets or creates the queue instance for persistent events.\n   *\n   * The async (BullMQ) producer is memoized process-wide so the per-request\n   * event bus reuses one Redis connection instead of leaking one per write\n   * request. The local strategy stays per-bus (no pooled connection, cwd-relative\n   * base dir). Set `OM_EVENTS_SHARED_PRODUCER=0` to fall back to per-bus producers.\n   */\n  function getQueue(): Queue<EventJobData> {\n    if (queueStrategy !== 'async' || !isSharedProducerEnabled()) {\n      if (!queue) {\n        queue = queueStrategy === 'async'\n          ? createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n              connection: { url: getRedisUrlOrThrow('QUEUE') },\n            })\n          : createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'local')\n      }\n      return queue\n    }\n\n    const redisUrl = getRedisUrlOrThrow('QUEUE')\n    const registry = getProducerQueueRegistry()\n    const cacheKey = `async:${redisUrl}`\n    let shared = registry.get(cacheKey)\n    if (!shared) {\n      shared = createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n        connection: { url: redisUrl },\n      })\n      registry.set(cacheKey, shared)\n      registerProducerShutdownHook()\n    }\n    return shared\n  }\n\n  /**\n   * Delivers an event to all registered in-memory handlers.\n   * Supports wildcard pattern matching for event patterns.\n   *\n   * Handler errors are logged and delivery continues - one bad subscriber must\n   * not stop the others. The count of failed PERSISTENT handlers is returned so\n   * the caller can decide whether the inline run may be recorded as complete:\n   * a persistent subscriber that threw inline has no retry of its own, so the\n   * queued job must stay unstamped and let the worker run it again.\n   */\n  async function deliver(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    skipPersistent = false,\n  ): Promise<{ persistentFailures: number }> {\n    let persistentFailures = 0\n    // Check all registered patterns (including wildcards)\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) continue\n      if (!handlers || handlers.size === 0) continue\n\n      for (const subscriber of handlers) {\n        // Single-delivery: persistent subscribers are dispatched by the worker,\n        // so skip them inline to avoid double execution.\n        if (skipPersistent && persistentSubscribers.has(subscriber)) continue\n        try {\n          // Pass eventName in context for wildcard handlers\n          const moduleId = subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id)\n          await withModuleResourceUsage(\n            {\n              moduleId,\n              surface: 'subscriber',\n              operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n              resourceId: subscriber.id ?? subscriber.event,\n            },\n            () => subscriber.handler(payload, {\n              resolve: opts.resolve,\n              eventName: event,\n              tenantId: options?.tenantId ?? null,\n              organizationId: options?.organizationId ?? null,\n            }),\n          )\n        } catch (error) {\n          if (persistentSubscribers.has(subscriber)) {\n            persistentFailures += 1\n          }\n          logger.error('Handler error', { event, pattern, err: error })\n          if (options?.rethrowHandlerErrors) {\n            throw error\n          }\n        }\n      }\n    }\n    return { persistentFailures }\n  }\n\n  /**\n   * Selects the subscribers the events worker owns for a queued event: every\n   * pattern matching `event`, keeping persistent subscribers only, so wildcard\n   * (`event: '*'`) persistent subscribers are reached exactly once here.\n   *\n   * Deliberately does NOT read `OM_EVENTS_SINGLE_DELIVERY`. Whether inline\n   * delivery already happened is carried by the job's `persistentDeliveredInline`\n   * stamp, so the producer owns that decision entirely and the worker cannot\n   * disagree with it across processes. Reading the flag here would reintroduce\n   * exactly that skew: a worker whose env has the flag off would fall back to\n   * exact-match, re-running ephemeral subscribers the producer already ran inline\n   * and never reaching wildcard persistent subscribers - the failure this whole\n   * change exists to remove.\n   *\n   * Every job that reaches this point wants persistent-pattern selection: a job\n   * is only dispatched when its stamp is false, which means either the producer\n   * had single-delivery on, or the emit was enqueue-only (`deliverInline: false`,\n   * documented as \"every subscriber to the event is persistent\").\n   */\n  function selectQueuedSubscribers(event: string): RegisteredSubscriber[] {\n    const matched: RegisteredSubscriber[] = []\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) {\n        continue\n      }\n      for (const subscriber of handlers) {\n        if (subscriber.persistent) {\n          matched.push(subscriber)\n        }\n      }\n    }\n    return matched\n  }\n\n  /**\n   * Dispatches a queued event on behalf of the events worker.\n   *\n   * Handler failures are returned instead of logged-and-swallowed the way\n   * `deliver()` does them: the worker needs them to propagate so the queue retries\n   * the job and eventually dead-letters it.\n   *\n   * Subscribers run against the caller's `resolve` when one is given, falling back\n   * to the bus's own. The events worker passes its per-job `ctx.resolve`, which is\n   * the container `createPerJobWorkerHandler` built for that job - the handle the\n   * queue contract already hands it. Defaulting to `opts.resolve` instead would\n   * bind subscribers to whichever container built the bus; that is the same object\n   * on the default configuration, but not under `OM_BOOTSTRAP_CACHE`, where the\n   * cached bus is replayed into later containers while its captured resolver stays\n   * bound to the first.\n   */\n  async function dispatchQueued(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    resolve?: <T = unknown>(name: string) => T,\n  ): Promise<QueuedDispatchResult[]> {\n    const subscribers = selectQueuedSubscribers(event)\n    if (subscribers.length === 0) {\n      return []\n    }\n\n    const resolver = resolve ?? opts.resolve\n\n    const settled = await Promise.allSettled(\n      subscribers.map((subscriber) =>\n        withModuleResourceUsage(\n          {\n            moduleId: subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id),\n            surface: 'subscriber',\n            operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n            resourceId: subscriber.id ?? subscriber.event,\n          },\n          () => subscriber.handler(payload, {\n            resolve: resolver,\n            eventName: event,\n            tenantId: options?.tenantId ?? null,\n            organizationId: options?.organizationId ?? null,\n          }),\n        ),\n      ),\n    )\n\n    return settled.map((result, index) => {\n      const subscriberId = subscribers[index].id ?? subscribers[index].event\n      return result.status === 'rejected'\n        ? { subscriberId, ok: false, error: result.reason }\n        : { subscriberId, ok: true }\n    })\n  }\n\n  /**\n   * Registers a handler for an event. Pass `moduleId` whenever the subscribing\n   * module is known (e.g. a module reacting to another module's event) so\n   * resource-usage telemetry attributes the handler correctly instead of\n   * guessing a module id from the event name.\n   */\n  function on(\n    event: string,\n    handler: SubscriberHandler,\n    options?: { persistent?: boolean; moduleId?: string; id?: string },\n  ): void {\n    if (!listeners.has(event)) {\n      listeners.set(event, new Set())\n    }\n    const subscriber: RegisteredSubscriber = {\n      id: options?.id,\n      moduleId: options?.moduleId,\n      event,\n      handler,\n      persistent: options?.persistent,\n    }\n    listeners.get(event)!.add(subscriber)\n    if (options?.persistent) {\n      persistentSubscribers.add(subscriber)\n    }\n  }\n\n  /**\n   * Registers multiple module subscribers at once.\n   */\n  function registerModuleSubscribers(subs: SubscriberDescriptor[]): void {\n    for (const sub of subs) {\n      on(sub.event, sub.handler, { persistent: sub.persistent, moduleId: sub.moduleId, id: sub.id })\n    }\n  }\n\n  /**\n   * Emits an event to all registered handlers.\n   *\n   * If `persistent: true`, also enqueues the event for async processing.\n   */\n  async function emit(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions\n  ): Promise<void> {\n    const runGlobalTaps = async (): Promise<void> => {\n      const taps = getGlobalEventTaps()\n      for (const tap of taps) {\n        try {\n          await Promise.resolve(tap(event, payload, options))\n        } catch (error) {\n          logger.error('Global tap error', { event, err: error })\n        }\n      }\n    }\n\n    // Resolved at call time, never hoisted. Private coordination always requires\n    // trusted envelope scope and module provenance. Legacy declared browser events\n    // may promote their typed scope for raw EventBus compatibility; tenant-managed\n    // workflow adapters pass authoritative scope in options, which always wins over\n    // payload values. Computing it lazily keeps the non-coalesced path resolving\n    // scope at exactly the point it always did \u2014 after inline delivery \u2014 so an\n    // event that did not opt in cannot observe this change at all.\n    const publishToOtherProcesses = async (): Promise<void> => {\n      const crossProcessOptions = resolveCrossProcessEmitOptions(event, payload, options)\n      if (\n        !isCrossProcessBroadcastEvent(event)\n        || !hasTrustedTenantScope(crossProcessOptions)\n        || !isPrivateCrossProcessEventEmitter(event, crossProcessOptions?.emitterModuleId)\n      ) return\n      try {\n        await publishCrossProcessEvent(event, payload, crossProcessOptions)\n      } catch (error) {\n        logger.error('Cross-process publish error', { event, err: error })\n      }\n    }\n\n    // Global taps are not a browser-only sink \u2014 `registerGlobalEventTap` is a\n    // public export that any process-local listener can use (the create-app\n    // template's qa-events route captures events for integration tests through\n    // it, and third-party modules can too), not just the two SSE endpoints. What\n    // both taps and the SSE bridges have in common is that neither carries domain\n    // meaning on its own, so an opted-in event may coalesce this dispatch \u2014 and\n    // with it every tap's delivery \u2014 without touching subscriber, webhook or\n    // queue semantics below. A tap on a coalesced event sees the same suppressed,\n    // trailing-flush-guaranteed stream the browser does, not one call per record.\n    const coalesceBrowserDelivery = isCoalescedBroadcastEvent(event)\n      && resolveBroadcastCoalesceIntervalMs() > 0\n    if (coalesceBrowserDelivery) {\n      await submitBroadcast(\n        buildBroadcastCoalesceKey(event, payload, options),\n        async () => {\n          await runGlobalTaps()\n          await publishToOtherProcesses()\n        },\n      )\n    } else {\n      await runGlobalTaps()\n    }\n\n    // Deliver to in-memory handlers first. Under single-delivery, persistent\n    // subscribers are skipped inline on a persistent emit because the events\n    // worker will dispatch them from the queue.\n    //\n    // `deliverInline: false` on a persistent emit is enqueue-only: skip inline\n    // delivery entirely so a heavy persistent job runs solely in the events\n    // worker, off the caller's request path (the queued enqueue below still\n    // happens). Without this, a persistent emit dual-dispatches by default and\n    // runs the subscriber inline in the caller's request too.\n    const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false\n    // Read the mode once so the inline skip and the stamp below cannot disagree.\n    const singleDelivery = isSingleDeliveryEnabled()\n    const skipPersistentInline = options?.skipPersistentSubscribersInline === true\n      || (Boolean(options?.persistent) && singleDelivery)\n    let inlinePersistentFailed = false\n    if (!enqueueOnly) {\n      const delivered = await deliver(event, payload, options, skipPersistentInline)\n      inlinePersistentFailed = delivered.persistentFailures > 0\n    }\n\n    // Already dispatched with the taps when this event coalesces its browser\n    // delivery; otherwise it publishes here, exactly where it always has.\n    if (!coalesceBrowserDelivery) {\n      await publishToOtherProcesses()\n    }\n\n    // If persistent, also enqueue for async processing\n    if (options?.persistent) {\n      const q = getQueue()\n      await q.enqueue({\n        event,\n        payload,\n        options,\n        // Only record the inline run as complete when every persistent\n        // subscriber actually succeeded. Inline delivery logs-and-continues, so a\n        // handler that threw has no retry of its own; leaving the job unstamped\n        // hands it to the worker, where a failure gets queue retry and\n        // dead-lettering. Without this, flipping the flag off (which the\n        // `mercato server` guard can do automatically) silently downgrades\n        // persistent delivery to at-most-once.\n        persistentDeliveredInline: !enqueueOnly && !skipPersistentInline && !inlinePersistentFailed,\n      })\n    }\n  }\n\n  /**\n   * Clears all events from the persistent queue.\n   */\n  async function clearQueue(): Promise<{ removed: number }> {\n    const q = getQueue()\n    return q.clear()\n  }\n\n  // Backward compatibility alias\n  const emitEvent = emit\n\n  return {\n    emit,\n    emitEvent, // Alias for backward compatibility\n    on,\n    registerModuleSubscribers,\n    dispatchQueued,\n    clearQueue,\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC,uCAAuC;AACnF,SAAS,gCAAgC;AAYzC,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ;AAyBpC,SAAS,0BAAmC;AAC1C,SAAO,0BAA0B;AACnC;AAGA,MAAM,wBAAwB;AAE9B,SAAS,sBAAsB,SAAgC;AAC7D,SAAO,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS;AACnF;AAEA,SAAS,sBAAsB,OAA+B;AAC5D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,+BACP,OACA,SACA,SACyB;AACzB,MAAI,sBAAsB,OAAO,EAAG,QAAO;AAK3C,MAAI,CAAC,iBAAiB,KAAK,EAAG,QAAO;AACrC,QAAM,WAAW,sBAAuB,SAAqC,QAAQ;AACrF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,iBAAiB,sBAAuB,SAAqC,cAAc;AACjG,QAAM,uBAAwB,SAAqC;AACnE,QAAM,kBAAkB,MAAM,QAAQ,oBAAoB,IACtD,qBAAqB,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACjF,CAAC;AACL,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC3C,GAAI,gBAAgB,SAAS,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC1D;AACF;AAEA,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAIA,SAAS,WAAW,QAA+B;AACjD,SAAO,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAC3E;AA0BA,SAAS,0BAA0B,OAAe,SAAuB,SAA+B;AACtG,QAAM,OAAQ,WAAW,CAAC;AAE1B,QAAM,kBAAkB,sBAAsB,KAAK,QAAQ,KAAK;AAChE,QAAM,qBAAqB,WAAW,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU,IAC1F,IAAI,sBAAsB,QAAQ,QAAQ,KAAK,EAAE,KACjD;AAEJ,QAAM,4BAA4B,oBAAI,IAAY;AAClD,QAAM,wBAAwB,sBAAsB,SAAS,cAAc;AAC3E,MAAI,sBAAuB,2BAA0B,IAAI,qBAAqB;AAC9E,aAAW,kBAAkB,oBAAoB,SAAS,eAAe,GAAG;AAC1E,8BAA0B,IAAI,cAAc;AAAA,EAC9C;AAEA,QAAM,4BAA4B,oBAAI,IAAY;AAClD,QAAM,wBAAwB,sBAAsB,KAAK,cAAc;AACvE,MAAI,sBAAuB,2BAA0B,IAAI,qBAAqB;AAC9E,aAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,8BAA0B,IAAI,cAAc;AAAA,EAC9C;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,QAAM,kBAAkB,sBAAsB,KAAK,eAAe;AAClE,MAAI,gBAAiB,qBAAoB,IAAI,eAAe;AAC5D,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,QAAM,kBAAkB,sBAAsB,KAAK,eAAe;AAClE,MAAI,gBAAiB,qBAAoB,IAAI,eAAe;AAC5D,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,yBAAyB,EAAE,KAAK,GAAG;AAAA,IAC9C,WAAW,yBAAyB,EAAE,KAAK,GAAG;AAAA,IAC9C,WAAW,mBAAmB,EAAE,KAAK,GAAG;AAAA,IACxC,WAAW,mBAAmB,EAAE,KAAK,GAAG;AAAA,EAC1C,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,qBAA0C;AACjD,QAAM,WAAY,WAAuC,qBAAqB;AAC9E,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAoB;AACvC,EAAC,WAAuC,qBAAqB,IAAI;AAClE,SAAO;AACT;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,QAAM,OAAO,mBAAmB;AAChC,OAAK,IAAI,OAAO;AAChB,SAAO,MAAM;AACX,SAAK,OAAO,OAAO;AAAA,EACrB;AACF;AA0BA,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,mCAAmC;AAEzC,SAAS,0BAAmC;AAC1C,SAAO,wBAAwB,QAAQ,IAAI,2BAA2B,IAAI;AAC5E;AAEA,SAAS,2BAA6D;AACpE,QAAM,WAAY,WAAuC,yBAAyB;AAClF,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAiC;AACpD,EAAC,WAAuC,yBAAyB,IAAI;AACtE,SAAO;AACT;AAEA,SAAS,+BAAqC;AAC5C,MAAK,WAAuC,4BAA4B,EAAG;AAC3E,QAAM,WAAW,MAAM;AACrB,UAAM,WAAW,yBAAyB;AAC1C,eAAW,eAAe,SAAS,OAAO,GAAG;AAC3C,cAAQ,QAAQ,YAAY,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD;AACA,aAAS,MAAM;AAAA,EACjB;AACA,UAAQ,KAAK,WAAW,QAAQ;AAChC,UAAQ,KAAK,UAAU,QAAQ;AAC9B,EAAC,WAAuC,4BAA4B,IAAI;AAC3E;AA6BA,SAAS,yCAA+C;AACtD,MAAK,WAAuC,gCAAgC,EAAG;AAC/E,QAAM,eAAe,CAAC,WAA2B;AAC/C,SAAK,uBAAuB,EAAE,YAAY,4BAA4B,CAAC,EACpE,MAAM,MAAM;AAAA,IAAC,CAAC,EACd,QAAQ,MAAM;AACb,UAAI,QAAQ,cAAc,MAAM,MAAM,GAAG;AACvC,gBAAQ,KAAK,QAAQ,KAAK,MAAM;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACL;AACA,UAAQ,KAAK,WAAW,MAAM,aAAa,SAAS,CAAC;AACrD,UAAQ,KAAK,UAAU,MAAM,aAAa,QAAQ,CAAC;AACnD,UAAQ,KAAK,cAAc,MAAM;AAC/B,SAAK,uBAAuB,EAAE,YAAY,4BAA4B,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACzF,CAAC;AACA,EAAC,WAAuC,gCAAgC,IAAI;AAC/E;AAgCO,SAAS,eAAe,MAAkC;AAC/D,yCAAuC;AAGvC,QAAM,YAAY,oBAAI,IAAuC;AAG7D,QAAM,wBAAwB,oBAAI,IAA0B;AAG5D,QAAM,gBAAgB,KAAK,kBACxB,QAAQ,IAAI,mBAAmB,UAAU,UAAU;AAGtD,MAAI,QAAoC;AAUxC,WAAS,WAAgC;AACvC,QAAI,kBAAkB,WAAW,CAAC,wBAAwB,GAAG;AAC3D,UAAI,CAAC,OAAO;AACV,gBAAQ,kBAAkB,UACtB,YAA0B,mBAAmB,SAAS;AAAA,UACpD,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,QACjD,CAAC,IACD,YAA0B,mBAAmB,OAAO;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,mBAAmB,OAAO;AAC3C,UAAM,WAAW,yBAAyB;AAC1C,UAAM,WAAW,SAAS,QAAQ;AAClC,QAAI,SAAS,SAAS,IAAI,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,eAAS,YAA0B,mBAAmB,SAAS;AAAA,QAC7D,YAAY,EAAE,KAAK,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,IAAI,UAAU,MAAM;AAC7B,mCAA6B;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAYA,iBAAe,QACb,OACA,SACA,SACA,iBAAiB,OACwB;AACzC,QAAI,qBAAqB;AAEzB,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,EAAG;AACxC,UAAI,CAAC,YAAY,SAAS,SAAS,EAAG;AAEtC,iBAAW,cAAc,UAAU;AAGjC,YAAI,kBAAkB,sBAAsB,IAAI,UAAU,EAAG;AAC7D,YAAI;AAEF,gBAAM,WAAW,WAAW,YAAY,4BAA4B,WAAW,EAAE;AACjF,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,SAAS;AAAA,cACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,cAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,YAC1C;AAAA,YACA,MAAM,WAAW,QAAQ,SAAS;AAAA,cAChC,SAAS,KAAK;AAAA,cACd,WAAW;AAAA,cACX,UAAU,SAAS,YAAY;AAAA,cAC/B,gBAAgB,SAAS,kBAAkB;AAAA,YAC7C,CAAC;AAAA,UACH;AAAA,QACF,SAAS,OAAO;AACd,cAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,kCAAsB;AAAA,UACxB;AACA,iBAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,KAAK,MAAM,CAAC;AAC5D,cAAI,SAAS,sBAAsB;AACjC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,mBAAmB;AAAA,EAC9B;AAqBA,WAAS,wBAAwB,OAAuC;AACtE,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,GAAG;AACtC;AAAA,MACF;AACA,iBAAW,cAAc,UAAU;AACjC,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAkBA,iBAAe,eACb,OACA,SACA,SACA,SACiC;AACjC,UAAM,cAAc,wBAAwB,KAAK;AACjD,QAAI,YAAY,WAAW,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,WAAW,WAAW,KAAK;AAEjC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,YAAY;AAAA,QAAI,CAAC,eACf;AAAA,UACE;AAAA,YACE,UAAU,WAAW,YAAY,4BAA4B,WAAW,EAAE;AAAA,YAC1E,SAAS;AAAA,YACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,YAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,UAC1C;AAAA,UACA,MAAM,WAAW,QAAQ,SAAS;AAAA,YAChC,SAAS;AAAA,YACT,WAAW;AAAA,YACX,UAAU,SAAS,YAAY;AAAA,YAC/B,gBAAgB,SAAS,kBAAkB;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,IAAI,CAAC,QAAQ,UAAU;AACpC,YAAM,eAAe,YAAY,KAAK,EAAE,MAAM,YAAY,KAAK,EAAE;AACjE,aAAO,OAAO,WAAW,aACrB,EAAE,cAAc,IAAI,OAAO,OAAO,OAAO,OAAO,IAChD,EAAE,cAAc,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAQA,WAAS,GACP,OACA,SACA,SACM;AACN,QAAI,CAAC,UAAU,IAAI,KAAK,GAAG;AACzB,gBAAU,IAAI,OAAO,oBAAI,IAAI,CAAC;AAAA,IAChC;AACA,UAAM,aAAmC;AAAA,MACvC,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,MACA,YAAY,SAAS;AAAA,IACvB;AACA,cAAU,IAAI,KAAK,EAAG,IAAI,UAAU;AACpC,QAAI,SAAS,YAAY;AACvB,4BAAsB,IAAI,UAAU;AAAA,IACtC;AAAA,EACF;AAKA,WAAS,0BAA0B,MAAoC;AACrE,eAAW,OAAO,MAAM;AACtB,SAAG,IAAI,OAAO,IAAI,SAAS,EAAE,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,IAAI,IAAI,GAAG,CAAC;AAAA,IAC/F;AAAA,EACF;AAOA,iBAAe,KACb,OACA,SACA,SACe;AACf,UAAM,gBAAgB,YAA2B;AAC/C,YAAM,OAAO,mBAAmB;AAChC,iBAAW,OAAO,MAAM;AACtB,YAAI;AACF,gBAAM,QAAQ,QAAQ,IAAI,OAAO,SAAS,OAAO,CAAC;AAAA,QACpD,SAAS,OAAO;AACd,iBAAO,MAAM,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AASA,UAAM,0BAA0B,YAA2B;AACzD,YAAM,sBAAsB,+BAA+B,OAAO,SAAS,OAAO;AAClF,UACE,CAAC,6BAA6B,KAAK,KAChC,CAAC,sBAAsB,mBAAmB,KAC1C,CAAC,kCAAkC,OAAO,qBAAqB,eAAe,EACjF;AACF,UAAI;AACF,cAAM,yBAAyB,OAAO,SAAS,mBAAmB;AAAA,MACpE,SAAS,OAAO;AACd,eAAO,MAAM,+BAA+B,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACnE;AAAA,IACF;AAWA,UAAM,0BAA0B,0BAA0B,KAAK,KAC1D,mCAAmC,IAAI;AAC5C,QAAI,yBAAyB;AAC3B,YAAM;AAAA,QACJ,0BAA0B,OAAO,SAAS,OAAO;AAAA,QACjD,YAAY;AACV,gBAAM,cAAc;AACpB,gBAAM,wBAAwB;AAAA,QAChC;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,cAAc;AAAA,IACtB;AAWA,UAAM,cAAc,QAAQ,SAAS,UAAU,KAAK,SAAS,kBAAkB;AAE/E,UAAM,iBAAiB,wBAAwB;AAC/C,UAAM,uBAAuB,SAAS,oCAAoC,QACpE,QAAQ,SAAS,UAAU,KAAK;AACtC,QAAI,yBAAyB;AAC7B,QAAI,CAAC,aAAa;AAChB,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,SAAS,oBAAoB;AAC7E,+BAAyB,UAAU,qBAAqB;AAAA,IAC1D;AAIA,QAAI,CAAC,yBAAyB;AAC5B,YAAM,wBAAwB;AAAA,IAChC;AAGA,QAAI,SAAS,YAAY;AACvB,YAAM,IAAI,SAAS;AACnB,YAAM,EAAE,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,2BAA2B,CAAC,eAAe,CAAC,wBAAwB,CAAC;AAAA,MACvE,CAAC;AAAA,IACH;AAAA,EACF;AAKA,iBAAe,aAA2C;AACxD,UAAM,IAAI,SAAS;AACnB,WAAO,EAAE,MAAM;AAAA,EACjB;AAGA,QAAM,YAAY;AAElB,SAAO;AAAA,IACL;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createQueue } from '@open-mercato/queue'\nimport type { Queue } from '@open-mercato/queue'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { isSingleDeliveryRequested } from './single-delivery'\nimport { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport {\n  isBroadcastEvent,\n  isCoalescedBroadcastEvent,\n  isCrossProcessBroadcastEvent,\n  isPortalBroadcastEvent,\n  isPrivateCrossProcessBroadcastEvent,\n  isPrivateCrossProcessEventEmitter,\n} from '@open-mercato/shared/modules/events'\nimport {\n  BROADCAST_FLUSH_DEADLINE_MS,\n  flushPendingBroadcasts,\n  resolveBroadcastCoalesceIntervalMs,\n  submitBroadcast,\n} from './broadcast-coalescer'\nimport {\n  inferModuleIdFromResourceId,\n  withModuleResourceUsage,\n} from '@open-mercato/shared/lib/modules/resource-usage'\nexport { registerCrossProcessEventListener, CROSS_PROCESS_EVENT_INSTANCE_ID } from './bridge'\nimport { publishCrossProcessEvent } from './bridge'\nimport type {\n  EventBus,\n  CreateBusOptions,\n  SubscriberHandler,\n  SubscriberDescriptor,\n  EventPayload,\n  EmitOptions,\n  QueuedDispatchResult,\n} from './types'\n\n/** Queue name for persistent events */\nconst EVENTS_QUEUE_NAME = 'events'\n\nconst logger = createLogger('events')\n\ntype RegisteredSubscriber = {\n  id?: string\n  moduleId?: string\n  event: string\n  handler: SubscriberHandler\n  persistent?: boolean\n}\n\n/**\n * When enabled, a persistent emit delivers each subscriber on exactly one path:\n * persistent-marked subscribers are skipped inline (the events worker dispatches\n * them via pattern match, so wildcard persistent subscribers are reached), while\n * ephemeral subscribers keep running inline. Defaults ON.\n *\n * The bus never second-guesses this against \"is a worker running\": the queue is\n * durable, so a persistent emit with no worker yet is delayed, not lost, and a\n * worker started later drains the backlog. Delivering inline instead would move\n * the work back onto the caller's request path \u2014 exactly what a split app/worker\n * deployment sets `AUTO_SPAWN_WORKERS=false` to avoid.\n *\n * The events worker asks this same bus for its subscribers via `dispatchQueued`,\n * so both halves of single-delivery read one decision.\n */\nfunction isSingleDeliveryEnabled(): boolean {\n  return isSingleDeliveryRequested()\n}\n\ntype GlobalEventTap = (event: string, payload: EventPayload, options?: EmitOptions) => void | Promise<void>\nconst GLOBAL_EVENT_TAPS_KEY = '__openMercatoEventBusGlobalTaps__'\n\nfunction hasTrustedTenantScope(options?: EmitOptions): boolean {\n  return typeof options?.tenantId === 'string' && options.tenantId.trim().length > 0\n}\n\nfunction normalizePayloadScope(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isBrowserBroadcastEvent(event: string): boolean {\n  return isBroadcastEvent(event) || isPortalBroadcastEvent(event)\n}\n\n/** Relayed over the bridge: both browser audiences plus private coordination; each consumer filters by its own flag. */\nfunction shouldPublishCrossProcess(event: string): boolean {\n  return isCrossProcessBroadcastEvent(event) || isPortalBroadcastEvent(event)\n}\n\nfunction resolveCrossProcessEmitOptions(\n  event: string,\n  payload: EventPayload,\n  options?: EmitOptions,\n): EmitOptions | undefined {\n  if (hasTrustedTenantScope(options)) return options\n  // Preserve the public raw EventBus contract for legacy clientBroadcast and\n  // portalBroadcast emitters. These callers are trusted server code and\n  // historically supplied their scope in the typed payload. Tenant-managed\n  // workflow execution passes scope in options, while private cross-process\n  // events never take this path.\n  if (!isBrowserBroadcastEvent(event) || isPrivateCrossProcessBroadcastEvent(event)) return options\n  const tenantId = normalizePayloadScope((payload as Record<string, unknown>)?.tenantId)\n  if (!tenantId) return options\n  const organizationId = normalizePayloadScope((payload as Record<string, unknown>)?.organizationId)\n  const organizationIdsValue = (payload as Record<string, unknown>)?.organizationIds\n  const organizationIds = Array.isArray(organizationIdsValue)\n    ? organizationIdsValue.filter((value): value is string => typeof value === 'string')\n    : []\n  return {\n    ...options,\n    tenantId,\n    ...(organizationId ? { organizationId } : {}),\n    ...(organizationIds.length > 0 ? { organizationIds } : {}),\n  }\n}\n\nfunction collectStringScopes(input: unknown): string[] {\n  if (!Array.isArray(input)) return []\n  const values: string[] = []\n  for (const value of input) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    values.push(trimmed)\n  }\n  return values\n}\n\n// Sorted so an audience keys identically however the caller ordered it, and\n// explicitly comparator-ed per the #3620 guard.\nfunction sortScopes(scopes: Set<string>): string[] {\n  return Array.from(scopes).sort((left, right) => left.localeCompare(right))\n}\n\n/**\n * Coalescing key for the browser dispatch of one event.\n *\n * Built from the raw union of every dimension the SSE audience filter\n * (`matchesAudience` in `events/api/stream/route.ts`) reads \u2014 tenant,\n * organization, recipient user and recipient role \u2014 taken from BOTH the\n * trusted `options` and the payload, without calling `resolveCrossProcessEmitOptions`\n * or any other resolver. Those resolvers pick one source to trust for delivery\n * semantics; the key instead has to key on every dimension a connection can be\n * filtered by, or one audience's emit would silently replace another\n * audience's pending delivery \u2014 recipient/role targeting and a portal-only\n * event (which carries no trusted `options` scope at all) included.\n *\n * Options and payload scope stay in separate segments, never merged: the three\n * filters each read a different source, so `options` org A + payload org B must\n * not key like the reverse. The options tenant segment encodes PRESENCE, not\n * just value \u2014 the backoffice `hasTrustedScope` is a presence test, so `{}` and\n * `{ tenantId: undefined }` take different filter branches and must not share\n * a key.\n *\n * Scope is part of the key by necessity, not for granularity: a key with no\n * scope segments would let a burst in one tenant suppress another tenant's\n * delivery and then deliver the first tenant's payload in its place.\n */\nfunction buildBroadcastCoalesceKey(event: string, payload: EventPayload, options?: EmitOptions): string {\n  const data = (payload ?? {}) as Record<string, unknown>\n\n  const payloadTenantId = normalizePayloadScope(data.tenantId) ?? ''\n  const optionsTenantToken = options && Object.prototype.hasOwnProperty.call(options, 'tenantId')\n    ? `=${normalizePayloadScope(options.tenantId) ?? ''}`\n    : 'absent'\n\n  const optionsOrganizationScopes = new Set<string>()\n  const optionsOrganizationId = normalizePayloadScope(options?.organizationId)\n  if (optionsOrganizationId) optionsOrganizationScopes.add(optionsOrganizationId)\n  for (const organizationId of collectStringScopes(options?.organizationIds)) {\n    optionsOrganizationScopes.add(organizationId)\n  }\n\n  const payloadOrganizationScopes = new Set<string>()\n  const payloadOrganizationId = normalizePayloadScope(data.organizationId)\n  if (payloadOrganizationId) payloadOrganizationScopes.add(payloadOrganizationId)\n  for (const organizationId of collectStringScopes(data.organizationIds)) {\n    payloadOrganizationScopes.add(organizationId)\n  }\n\n  const recipientUserScopes = new Set<string>()\n  const recipientUserId = normalizePayloadScope(data.recipientUserId)\n  if (recipientUserId) recipientUserScopes.add(recipientUserId)\n  for (const userId of collectStringScopes(data.recipientUserIds)) {\n    recipientUserScopes.add(userId)\n  }\n\n  const recipientRoleScopes = new Set<string>()\n  const recipientRoleId = normalizePayloadScope(data.recipientRoleId)\n  if (recipientRoleId) recipientRoleScopes.add(recipientRoleId)\n  for (const roleId of collectStringScopes(data.recipientRoleIds)) {\n    recipientRoleScopes.add(roleId)\n  }\n\n  return [\n    event,\n    payloadTenantId,\n    optionsTenantToken,\n    sortScopes(payloadOrganizationScopes).join(','),\n    sortScopes(optionsOrganizationScopes).join(','),\n    sortScopes(recipientUserScopes).join(','),\n    sortScopes(recipientRoleScopes).join(','),\n  ].join('::')\n}\n\nfunction getGlobalEventTaps(): Set<GlobalEventTap> {\n  const existing = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY]\n  if (existing instanceof Set) {\n    return existing as Set<GlobalEventTap>\n  }\n  const created = new Set<GlobalEventTap>()\n  ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_TAPS_KEY] = created\n  return created\n}\n\nexport function registerGlobalEventTap(handler: GlobalEventTap): () => void {\n  const taps = getGlobalEventTaps()\n  taps.add(handler)\n  return () => {\n    taps.delete(handler)\n  }\n}\n\n/** Job data structure for queued events */\ntype EventJobData = {\n  event: string\n  payload: EventPayload\n  options?: EmitOptions\n  /**\n   * Set by the producer when it already ran the persistent subscribers inline\n   * (single-delivery reconciled off). The worker skips such jobs, so the app and\n   * the worker staying exactly-once no longer depends on both processes agreeing\n   * about `OM_EVENTS_SINGLE_DELIVERY`. Absent on jobs queued before this field\n   * existed, which keeps their behavior unchanged.\n   */\n  persistentDeliveredInline?: boolean\n}\n\n// Process-wide cache of the async (BullMQ) persistent-events producer queue.\n// Each authenticated request builds a fresh DI container and event bus, so a\n// per-bus producer queue opened a new ioredis connection per write request that\n// was never closed \u2014 leaking one Redis connection per request until maxclients\n// exhaustion. Memoizing the producer on `globalThis` (keyed by Redis URL, so a\n// reconfigured URL still gets its own queue) keeps it at one connection per\n// process, mirroring the `GLOBAL_EVENT_TAPS_KEY` and `getCachedRateLimiterService`\n// patterns. The local (file-based) strategy holds no pooled connection and its\n// base dir is cwd-relative, so it stays per-bus.\nconst EVENTS_PRODUCER_QUEUE_KEY = '__openMercatoEventsProducerQueues__'\nconst EVENTS_PRODUCER_SHUTDOWN_KEY = '__openMercatoEventsProducerShutdown__'\nconst BROADCAST_COALESCER_SHUTDOWN_KEY = '__openMercatoBroadcastCoalescerShutdown__'\n\nfunction isSharedProducerEnabled(): boolean {\n  return parseBooleanWithDefault(process.env.OM_EVENTS_SHARED_PRODUCER, true)\n}\n\nfunction getProducerQueueRegistry(): Map<string, Queue<EventJobData>> {\n  const existing = (globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Queue<EventJobData>>\n  }\n  const created = new Map<string, Queue<EventJobData>>()\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_QUEUE_KEY] = created\n  return created\n}\n\nfunction registerProducerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY]) return\n  const shutdown = () => {\n    const registry = getProducerQueueRegistry()\n    for (const sharedQueue of registry.values()) {\n      Promise.resolve(sharedQueue.close()).catch(() => {})\n    }\n    registry.clear()\n  }\n  process.once('SIGTERM', shutdown)\n  process.once('SIGINT', shutdown)\n  ;(globalThis as Record<string, unknown>)[EVENTS_PRODUCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Deliver the tail of any in-flight coalesced burst on the way out, so stopping\n * a worker mid-import does not leave browsers a window behind. Registered\n * independently of the producer hook: coalescing is in play whether or not this\n * process ever opened an async producer queue.\n *\n * `beforeExit` matters as much as the signals here. The trailing timer is\n * unref'd so a pending browser delivery never holds a process open, which means\n * a short-lived emitter \u2014 a CLI import, a one-shot script \u2014 reaches a natural\n * exit with the tail still queued and no signal ever fired. `beforeExit` runs\n * exactly when the loop has drained, which is precisely that case.\n *\n * `createEventBus` calls this in every process that bootstraps DI \u2014 the app,\n * every worker, and every `mercato` CLI command \u2014 so a bare `process.once`\n * listener here would take away Node's default SIGINT/SIGTERM exit process-wide:\n * once ANY listener is registered for a signal, Node stops exiting on it, and\n * this listener only flushes, never exits. A one-shot CLI command (seed,\n * import, reindex) with no graceful-shutdown handler of its own would then\n * swallow the first Ctrl+C or SIGTERM and keep running until SIGKILL. The\n * per-signal handler below flushes, then restores the default behavior itself\n * \u2014 by re-raising the signal \u2014 but only when it was the last listener\n * (`once` already removed itself before this body runs): a process with its\n * own graceful-shutdown handler (the queue worker, `mercato server`) keeps\n * that handler in charge of the actual exit, and this hook just adds the flush\n * alongside it. Every flush here is capped at BROADCAST_FLUSH_DEADLINE_MS, so a\n * hung dispatch cannot hold a stop until SIGKILL.\n */\nfunction registerBroadcastCoalescerShutdownHook(): void {\n  if ((globalThis as Record<string, unknown>)[BROADCAST_COALESCER_SHUTDOWN_KEY]) return\n  const handleSignal = (signal: NodeJS.Signals) => {\n    void flushPendingBroadcasts({ deadlineMs: BROADCAST_FLUSH_DEADLINE_MS })\n      .catch(() => {})\n      .finally(() => {\n        if (process.listenerCount(signal) === 0) {\n          process.kill(process.pid, signal)\n        }\n      })\n  }\n  process.once('SIGTERM', () => handleSignal('SIGTERM'))\n  process.once('SIGINT', () => handleSignal('SIGINT'))\n  process.once('beforeExit', () => {\n    void flushPendingBroadcasts({ deadlineMs: BROADCAST_FLUSH_DEADLINE_MS }).catch(() => {})\n  })\n  ;(globalThis as Record<string, unknown>)[BROADCAST_COALESCER_SHUTDOWN_KEY] = true\n}\n\n/**\n * Creates an event bus instance.\n *\n * The event bus provides:\n * - In-memory event delivery to registered handlers\n * - Optional persistence via the queue package when `persistent: true`\n *\n * @param opts - Configuration options\n * @returns An EventBus instance\n *\n * @example\n * ```typescript\n * const bus = createEventBus({\n *   resolve: container.resolve.bind(container),\n *   queueStrategy: 'local', // or 'async' for BullMQ\n * })\n *\n * // Register a handler\n * bus.on('user.created', async (payload, ctx) => {\n *   const userService = ctx.resolve('userService')\n *   await userService.sendWelcomeEmail(payload.userId)\n * })\n *\n * // Emit an event (immediate delivery)\n * await bus.emit('user.created', { userId: '123' })\n *\n * // Emit with persistence (for async worker processing)\n * await bus.emit('order.placed', { orderId: '456' }, { persistent: true })\n * ```\n */\nexport function createEventBus(opts: CreateBusOptions): EventBus {\n  registerBroadcastCoalescerShutdownHook()\n\n  // In-memory listeners for immediate event delivery\n  const listeners = new Map<string, Set<RegisteredSubscriber>>()\n  // Subscribers registered as persistent (worker-dispatched). Used by the\n  // single-delivery path to skip them inline on a persistent emit.\n  const persistentSubscribers = new Set<RegisteredSubscriber>()\n\n  // Determine queue strategy from options or environment\n  const queueStrategy = opts.queueStrategy ??\n    (process.env.QUEUE_STRATEGY === 'async' ? 'async' : 'local')\n\n  // Lazy-initialized queue for persistent events\n  let queue: Queue<EventJobData> | null = null\n\n  /**\n   * Gets or creates the queue instance for persistent events.\n   *\n   * The async (BullMQ) producer is memoized process-wide so the per-request\n   * event bus reuses one Redis connection instead of leaking one per write\n   * request. The local strategy stays per-bus (no pooled connection, cwd-relative\n   * base dir). Set `OM_EVENTS_SHARED_PRODUCER=0` to fall back to per-bus producers.\n   */\n  function getQueue(): Queue<EventJobData> {\n    if (queueStrategy !== 'async' || !isSharedProducerEnabled()) {\n      if (!queue) {\n        queue = queueStrategy === 'async'\n          ? createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n              connection: { url: getRedisUrlOrThrow('QUEUE') },\n            })\n          : createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'local')\n      }\n      return queue\n    }\n\n    const redisUrl = getRedisUrlOrThrow('QUEUE')\n    const registry = getProducerQueueRegistry()\n    const cacheKey = `async:${redisUrl}`\n    let shared = registry.get(cacheKey)\n    if (!shared) {\n      shared = createQueue<EventJobData>(EVENTS_QUEUE_NAME, 'async', {\n        connection: { url: redisUrl },\n      })\n      registry.set(cacheKey, shared)\n      registerProducerShutdownHook()\n    }\n    return shared\n  }\n\n  /**\n   * Delivers an event to all registered in-memory handlers.\n   * Supports wildcard pattern matching for event patterns.\n   *\n   * Handler errors are logged and delivery continues - one bad subscriber must\n   * not stop the others. The count of failed PERSISTENT handlers is returned so\n   * the caller can decide whether the inline run may be recorded as complete:\n   * a persistent subscriber that threw inline has no retry of its own, so the\n   * queued job must stay unstamped and let the worker run it again.\n   */\n  async function deliver(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    skipPersistent = false,\n  ): Promise<{ persistentFailures: number }> {\n    let persistentFailures = 0\n    // Check all registered patterns (including wildcards)\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) continue\n      if (!handlers || handlers.size === 0) continue\n\n      for (const subscriber of handlers) {\n        // Single-delivery: persistent subscribers are dispatched by the worker,\n        // so skip them inline to avoid double execution.\n        if (skipPersistent && persistentSubscribers.has(subscriber)) continue\n        try {\n          // Pass eventName in context for wildcard handlers\n          const moduleId = subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id)\n          await withModuleResourceUsage(\n            {\n              moduleId,\n              surface: 'subscriber',\n              operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n              resourceId: subscriber.id ?? subscriber.event,\n            },\n            () => subscriber.handler(payload, {\n              resolve: opts.resolve,\n              eventName: event,\n              tenantId: options?.tenantId ?? null,\n              organizationId: options?.organizationId ?? null,\n            }),\n          )\n        } catch (error) {\n          if (persistentSubscribers.has(subscriber)) {\n            persistentFailures += 1\n          }\n          logger.error('Handler error', { event, pattern, err: error })\n          if (options?.rethrowHandlerErrors) {\n            throw error\n          }\n        }\n      }\n    }\n    return { persistentFailures }\n  }\n\n  /**\n   * Selects the subscribers the events worker owns for a queued event: every\n   * pattern matching `event`, keeping persistent subscribers only, so wildcard\n   * (`event: '*'`) persistent subscribers are reached exactly once here.\n   *\n   * Deliberately does NOT read `OM_EVENTS_SINGLE_DELIVERY`. Whether inline\n   * delivery already happened is carried by the job's `persistentDeliveredInline`\n   * stamp, so the producer owns that decision entirely and the worker cannot\n   * disagree with it across processes. Reading the flag here would reintroduce\n   * exactly that skew: a worker whose env has the flag off would fall back to\n   * exact-match, re-running ephemeral subscribers the producer already ran inline\n   * and never reaching wildcard persistent subscribers - the failure this whole\n   * change exists to remove.\n   *\n   * Every job that reaches this point wants persistent-pattern selection: a job\n   * is only dispatched when its stamp is false, which means either the producer\n   * had single-delivery on, or the emit was enqueue-only (`deliverInline: false`,\n   * documented as \"every subscriber to the event is persistent\").\n   */\n  function selectQueuedSubscribers(event: string): RegisteredSubscriber[] {\n    const matched: RegisteredSubscriber[] = []\n    for (const [pattern, handlers] of listeners) {\n      if (!matchEventPattern(event, pattern)) {\n        continue\n      }\n      for (const subscriber of handlers) {\n        if (subscriber.persistent) {\n          matched.push(subscriber)\n        }\n      }\n    }\n    return matched\n  }\n\n  /**\n   * Dispatches a queued event on behalf of the events worker.\n   *\n   * Handler failures are returned instead of logged-and-swallowed the way\n   * `deliver()` does them: the worker needs them to propagate so the queue retries\n   * the job and eventually dead-letters it.\n   *\n   * Subscribers run against the caller's `resolve` when one is given, falling back\n   * to the bus's own. The events worker passes its per-job `ctx.resolve`, which is\n   * the container `createPerJobWorkerHandler` built for that job - the handle the\n   * queue contract already hands it. Defaulting to `opts.resolve` instead would\n   * bind subscribers to whichever container built the bus; that is the same object\n   * on the default configuration, but not under `OM_BOOTSTRAP_CACHE`, where the\n   * cached bus is replayed into later containers while its captured resolver stays\n   * bound to the first.\n   */\n  async function dispatchQueued(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions,\n    resolve?: <T = unknown>(name: string) => T,\n  ): Promise<QueuedDispatchResult[]> {\n    const subscribers = selectQueuedSubscribers(event)\n    if (subscribers.length === 0) {\n      return []\n    }\n\n    const resolver = resolve ?? opts.resolve\n\n    const settled = await Promise.allSettled(\n      subscribers.map((subscriber) =>\n        withModuleResourceUsage(\n          {\n            moduleId: subscriber.moduleId ?? inferModuleIdFromResourceId(subscriber.id),\n            surface: 'subscriber',\n            operation: `${event} -> ${subscriber.id ?? subscriber.event}`,\n            resourceId: subscriber.id ?? subscriber.event,\n          },\n          () => subscriber.handler(payload, {\n            resolve: resolver,\n            eventName: event,\n            tenantId: options?.tenantId ?? null,\n            organizationId: options?.organizationId ?? null,\n          }),\n        ),\n      ),\n    )\n\n    return settled.map((result, index) => {\n      const subscriberId = subscribers[index].id ?? subscribers[index].event\n      return result.status === 'rejected'\n        ? { subscriberId, ok: false, error: result.reason }\n        : { subscriberId, ok: true }\n    })\n  }\n\n  /**\n   * Registers a handler for an event. Pass `moduleId` whenever the subscribing\n   * module is known (e.g. a module reacting to another module's event) so\n   * resource-usage telemetry attributes the handler correctly instead of\n   * guessing a module id from the event name.\n   */\n  function on(\n    event: string,\n    handler: SubscriberHandler,\n    options?: { persistent?: boolean; moduleId?: string; id?: string },\n  ): void {\n    if (!listeners.has(event)) {\n      listeners.set(event, new Set())\n    }\n    const subscriber: RegisteredSubscriber = {\n      id: options?.id,\n      moduleId: options?.moduleId,\n      event,\n      handler,\n      persistent: options?.persistent,\n    }\n    listeners.get(event)!.add(subscriber)\n    if (options?.persistent) {\n      persistentSubscribers.add(subscriber)\n    }\n  }\n\n  /**\n   * Registers multiple module subscribers at once.\n   */\n  function registerModuleSubscribers(subs: SubscriberDescriptor[]): void {\n    for (const sub of subs) {\n      on(sub.event, sub.handler, { persistent: sub.persistent, moduleId: sub.moduleId, id: sub.id })\n    }\n  }\n\n  /**\n   * Emits an event to all registered handlers.\n   *\n   * If `persistent: true`, also enqueues the event for async processing.\n   */\n  async function emit(\n    event: string,\n    payload: EventPayload,\n    options?: EmitOptions\n  ): Promise<void> {\n    const runGlobalTaps = async (): Promise<void> => {\n      const taps = getGlobalEventTaps()\n      for (const tap of taps) {\n        try {\n          await Promise.resolve(tap(event, payload, options))\n        } catch (error) {\n          logger.error('Global tap error', { event, err: error })\n        }\n      }\n    }\n\n    // Resolved at call time, never hoisted. Private coordination always requires\n    // trusted envelope scope and module provenance. Legacy declared browser events\n    // may promote their typed scope for raw EventBus compatibility; tenant-managed\n    // workflow adapters pass authoritative scope in options, which always wins over\n    // payload values. Computing it lazily keeps the non-coalesced path resolving\n    // scope at exactly the point it always did \u2014 after inline delivery \u2014 so an\n    // event that did not opt in cannot observe this change at all.\n    const publishToOtherProcesses = async (): Promise<void> => {\n      const crossProcessOptions = resolveCrossProcessEmitOptions(event, payload, options)\n      if (\n        !shouldPublishCrossProcess(event)\n        || !hasTrustedTenantScope(crossProcessOptions)\n        || !isPrivateCrossProcessEventEmitter(event, crossProcessOptions?.emitterModuleId)\n      ) return\n      try {\n        await publishCrossProcessEvent(event, payload, crossProcessOptions)\n      } catch (error) {\n        logger.error('Cross-process publish error', { event, err: error })\n      }\n    }\n\n    // Global taps are not a browser-only sink \u2014 `registerGlobalEventTap` is a\n    // public export that any process-local listener can use (the create-app\n    // template's qa-events route captures events for integration tests through\n    // it, and third-party modules can too), not just the two SSE endpoints. What\n    // both taps and the SSE bridges have in common is that neither carries domain\n    // meaning on its own, so an opted-in event may coalesce this dispatch \u2014 and\n    // with it every tap's delivery \u2014 without touching subscriber, webhook or\n    // queue semantics below. A tap on a coalesced event sees the same suppressed,\n    // trailing-flush-guaranteed stream the browser does, not one call per record.\n    const coalesceBrowserDelivery = isCoalescedBroadcastEvent(event)\n      && resolveBroadcastCoalesceIntervalMs() > 0\n    if (coalesceBrowserDelivery) {\n      await submitBroadcast(\n        buildBroadcastCoalesceKey(event, payload, options),\n        async () => {\n          await runGlobalTaps()\n          await publishToOtherProcesses()\n        },\n      )\n    } else {\n      await runGlobalTaps()\n    }\n\n    // Deliver to in-memory handlers first. Under single-delivery, persistent\n    // subscribers are skipped inline on a persistent emit because the events\n    // worker will dispatch them from the queue.\n    //\n    // `deliverInline: false` on a persistent emit is enqueue-only: skip inline\n    // delivery entirely so a heavy persistent job runs solely in the events\n    // worker, off the caller's request path (the queued enqueue below still\n    // happens). Without this, a persistent emit dual-dispatches by default and\n    // runs the subscriber inline in the caller's request too.\n    const enqueueOnly = Boolean(options?.persistent) && options?.deliverInline === false\n    // Read the mode once so the inline skip and the stamp below cannot disagree.\n    const singleDelivery = isSingleDeliveryEnabled()\n    const skipPersistentInline = options?.skipPersistentSubscribersInline === true\n      || (Boolean(options?.persistent) && singleDelivery)\n    let inlinePersistentFailed = false\n    if (!enqueueOnly) {\n      const delivered = await deliver(event, payload, options, skipPersistentInline)\n      inlinePersistentFailed = delivered.persistentFailures > 0\n    }\n\n    // Already dispatched with the taps when this event coalesces its browser\n    // delivery; otherwise it publishes here, exactly where it always has.\n    if (!coalesceBrowserDelivery) {\n      await publishToOtherProcesses()\n    }\n\n    // If persistent, also enqueue for async processing\n    if (options?.persistent) {\n      const q = getQueue()\n      await q.enqueue({\n        event,\n        payload,\n        options,\n        // Only record the inline run as complete when every persistent\n        // subscriber actually succeeded. Inline delivery logs-and-continues, so a\n        // handler that threw has no retry of its own; leaving the job unstamped\n        // hands it to the worker, where a failure gets queue retry and\n        // dead-lettering. Without this, flipping the flag off (which the\n        // `mercato server` guard can do automatically) silently downgrades\n        // persistent delivery to at-most-once.\n        persistentDeliveredInline: !enqueueOnly && !skipPersistentInline && !inlinePersistentFailed,\n      })\n    }\n  }\n\n  /**\n   * Clears all events from the persistent queue.\n   */\n  async function clearQueue(): Promise<{ removed: number }> {\n    const q = getQueue()\n    return q.clear()\n  }\n\n  // Backward compatibility alias\n  const emitEvent = emit\n\n  return {\n    emit,\n    emitEvent, // Alias for backward compatibility\n    on,\n    registerModuleSubscribers,\n    dispatchQueued,\n    clearQueue,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,mBAAmB;AAE5B,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC,uCAAuC;AACnF,SAAS,gCAAgC;AAYzC,MAAM,oBAAoB;AAE1B,MAAM,SAAS,aAAa,QAAQ;AAyBpC,SAAS,0BAAmC;AAC1C,SAAO,0BAA0B;AACnC;AAGA,MAAM,wBAAwB;AAE9B,SAAS,sBAAsB,SAAgC;AAC7D,SAAO,OAAO,SAAS,aAAa,YAAY,QAAQ,SAAS,KAAK,EAAE,SAAS;AACnF;AAEA,SAAS,sBAAsB,OAA+B;AAC5D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,iBAAiB,KAAK,KAAK,uBAAuB,KAAK;AAChE;AAGA,SAAS,0BAA0B,OAAwB;AACzD,SAAO,6BAA6B,KAAK,KAAK,uBAAuB,KAAK;AAC5E;AAEA,SAAS,+BACP,OACA,SACA,SACyB;AACzB,MAAI,sBAAsB,OAAO,EAAG,QAAO;AAM3C,MAAI,CAAC,wBAAwB,KAAK,KAAK,oCAAoC,KAAK,EAAG,QAAO;AAC1F,QAAM,WAAW,sBAAuB,SAAqC,QAAQ;AACrF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,iBAAiB,sBAAuB,SAAqC,cAAc;AACjG,QAAM,uBAAwB,SAAqC;AACnE,QAAM,kBAAkB,MAAM,QAAQ,oBAAoB,IACtD,qBAAqB,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IACjF,CAAC;AACL,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC3C,GAAI,gBAAgB,SAAS,IAAI,EAAE,gBAAgB,IAAI,CAAC;AAAA,EAC1D;AACF;AAEA,SAAS,oBAAoB,OAA0B;AACrD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAIA,SAAS,WAAW,QAA+B;AACjD,SAAO,MAAM,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAC3E;AA0BA,SAAS,0BAA0B,OAAe,SAAuB,SAA+B;AACtG,QAAM,OAAQ,WAAW,CAAC;AAE1B,QAAM,kBAAkB,sBAAsB,KAAK,QAAQ,KAAK;AAChE,QAAM,qBAAqB,WAAW,OAAO,UAAU,eAAe,KAAK,SAAS,UAAU,IAC1F,IAAI,sBAAsB,QAAQ,QAAQ,KAAK,EAAE,KACjD;AAEJ,QAAM,4BAA4B,oBAAI,IAAY;AAClD,QAAM,wBAAwB,sBAAsB,SAAS,cAAc;AAC3E,MAAI,sBAAuB,2BAA0B,IAAI,qBAAqB;AAC9E,aAAW,kBAAkB,oBAAoB,SAAS,eAAe,GAAG;AAC1E,8BAA0B,IAAI,cAAc;AAAA,EAC9C;AAEA,QAAM,4BAA4B,oBAAI,IAAY;AAClD,QAAM,wBAAwB,sBAAsB,KAAK,cAAc;AACvE,MAAI,sBAAuB,2BAA0B,IAAI,qBAAqB;AAC9E,aAAW,kBAAkB,oBAAoB,KAAK,eAAe,GAAG;AACtE,8BAA0B,IAAI,cAAc;AAAA,EAC9C;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,QAAM,kBAAkB,sBAAsB,KAAK,eAAe;AAClE,MAAI,gBAAiB,qBAAoB,IAAI,eAAe;AAC5D,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,QAAM,kBAAkB,sBAAsB,KAAK,eAAe;AAClE,MAAI,gBAAiB,qBAAoB,IAAI,eAAe;AAC5D,aAAW,UAAU,oBAAoB,KAAK,gBAAgB,GAAG;AAC/D,wBAAoB,IAAI,MAAM;AAAA,EAChC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,yBAAyB,EAAE,KAAK,GAAG;AAAA,IAC9C,WAAW,yBAAyB,EAAE,KAAK,GAAG;AAAA,IAC9C,WAAW,mBAAmB,EAAE,KAAK,GAAG;AAAA,IACxC,WAAW,mBAAmB,EAAE,KAAK,GAAG;AAAA,EAC1C,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,qBAA0C;AACjD,QAAM,WAAY,WAAuC,qBAAqB;AAC9E,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAoB;AACvC,EAAC,WAAuC,qBAAqB,IAAI;AAClE,SAAO;AACT;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,QAAM,OAAO,mBAAmB;AAChC,OAAK,IAAI,OAAO;AAChB,SAAO,MAAM;AACX,SAAK,OAAO,OAAO;AAAA,EACrB;AACF;AA0BA,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,mCAAmC;AAEzC,SAAS,0BAAmC;AAC1C,SAAO,wBAAwB,QAAQ,IAAI,2BAA2B,IAAI;AAC5E;AAEA,SAAS,2BAA6D;AACpE,QAAM,WAAY,WAAuC,yBAAyB;AAClF,MAAI,oBAAoB,KAAK;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,UAAU,oBAAI,IAAiC;AACpD,EAAC,WAAuC,yBAAyB,IAAI;AACtE,SAAO;AACT;AAEA,SAAS,+BAAqC;AAC5C,MAAK,WAAuC,4BAA4B,EAAG;AAC3E,QAAM,WAAW,MAAM;AACrB,UAAM,WAAW,yBAAyB;AAC1C,eAAW,eAAe,SAAS,OAAO,GAAG;AAC3C,cAAQ,QAAQ,YAAY,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD;AACA,aAAS,MAAM;AAAA,EACjB;AACA,UAAQ,KAAK,WAAW,QAAQ;AAChC,UAAQ,KAAK,UAAU,QAAQ;AAC9B,EAAC,WAAuC,4BAA4B,IAAI;AAC3E;AA6BA,SAAS,yCAA+C;AACtD,MAAK,WAAuC,gCAAgC,EAAG;AAC/E,QAAM,eAAe,CAAC,WAA2B;AAC/C,SAAK,uBAAuB,EAAE,YAAY,4BAA4B,CAAC,EACpE,MAAM,MAAM;AAAA,IAAC,CAAC,EACd,QAAQ,MAAM;AACb,UAAI,QAAQ,cAAc,MAAM,MAAM,GAAG;AACvC,gBAAQ,KAAK,QAAQ,KAAK,MAAM;AAAA,MAClC;AAAA,IACF,CAAC;AAAA,EACL;AACA,UAAQ,KAAK,WAAW,MAAM,aAAa,SAAS,CAAC;AACrD,UAAQ,KAAK,UAAU,MAAM,aAAa,QAAQ,CAAC;AACnD,UAAQ,KAAK,cAAc,MAAM;AAC/B,SAAK,uBAAuB,EAAE,YAAY,4BAA4B,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACzF,CAAC;AACA,EAAC,WAAuC,gCAAgC,IAAI;AAC/E;AAgCO,SAAS,eAAe,MAAkC;AAC/D,yCAAuC;AAGvC,QAAM,YAAY,oBAAI,IAAuC;AAG7D,QAAM,wBAAwB,oBAAI,IAA0B;AAG5D,QAAM,gBAAgB,KAAK,kBACxB,QAAQ,IAAI,mBAAmB,UAAU,UAAU;AAGtD,MAAI,QAAoC;AAUxC,WAAS,WAAgC;AACvC,QAAI,kBAAkB,WAAW,CAAC,wBAAwB,GAAG;AAC3D,UAAI,CAAC,OAAO;AACV,gBAAQ,kBAAkB,UACtB,YAA0B,mBAAmB,SAAS;AAAA,UACpD,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,QACjD,CAAC,IACD,YAA0B,mBAAmB,OAAO;AAAA,MAC1D;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,mBAAmB,OAAO;AAC3C,UAAM,WAAW,yBAAyB;AAC1C,UAAM,WAAW,SAAS,QAAQ;AAClC,QAAI,SAAS,SAAS,IAAI,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,eAAS,YAA0B,mBAAmB,SAAS;AAAA,QAC7D,YAAY,EAAE,KAAK,SAAS;AAAA,MAC9B,CAAC;AACD,eAAS,IAAI,UAAU,MAAM;AAC7B,mCAA6B;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AAYA,iBAAe,QACb,OACA,SACA,SACA,iBAAiB,OACwB;AACzC,QAAI,qBAAqB;AAEzB,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,EAAG;AACxC,UAAI,CAAC,YAAY,SAAS,SAAS,EAAG;AAEtC,iBAAW,cAAc,UAAU;AAGjC,YAAI,kBAAkB,sBAAsB,IAAI,UAAU,EAAG;AAC7D,YAAI;AAEF,gBAAM,WAAW,WAAW,YAAY,4BAA4B,WAAW,EAAE;AACjF,gBAAM;AAAA,YACJ;AAAA,cACE;AAAA,cACA,SAAS;AAAA,cACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,cAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,YAC1C;AAAA,YACA,MAAM,WAAW,QAAQ,SAAS;AAAA,cAChC,SAAS,KAAK;AAAA,cACd,WAAW;AAAA,cACX,UAAU,SAAS,YAAY;AAAA,cAC/B,gBAAgB,SAAS,kBAAkB;AAAA,YAC7C,CAAC;AAAA,UACH;AAAA,QACF,SAAS,OAAO;AACd,cAAI,sBAAsB,IAAI,UAAU,GAAG;AACzC,kCAAsB;AAAA,UACxB;AACA,iBAAO,MAAM,iBAAiB,EAAE,OAAO,SAAS,KAAK,MAAM,CAAC;AAC5D,cAAI,SAAS,sBAAsB;AACjC,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,mBAAmB;AAAA,EAC9B;AAqBA,WAAS,wBAAwB,OAAuC;AACtE,UAAM,UAAkC,CAAC;AACzC,eAAW,CAAC,SAAS,QAAQ,KAAK,WAAW;AAC3C,UAAI,CAAC,kBAAkB,OAAO,OAAO,GAAG;AACtC;AAAA,MACF;AACA,iBAAW,cAAc,UAAU;AACjC,YAAI,WAAW,YAAY;AACzB,kBAAQ,KAAK,UAAU;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAkBA,iBAAe,eACb,OACA,SACA,SACA,SACiC;AACjC,UAAM,cAAc,wBAAwB,KAAK;AACjD,QAAI,YAAY,WAAW,GAAG;AAC5B,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,WAAW,WAAW,KAAK;AAEjC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,YAAY;AAAA,QAAI,CAAC,eACf;AAAA,UACE;AAAA,YACE,UAAU,WAAW,YAAY,4BAA4B,WAAW,EAAE;AAAA,YAC1E,SAAS;AAAA,YACT,WAAW,GAAG,KAAK,OAAO,WAAW,MAAM,WAAW,KAAK;AAAA,YAC3D,YAAY,WAAW,MAAM,WAAW;AAAA,UAC1C;AAAA,UACA,MAAM,WAAW,QAAQ,SAAS;AAAA,YAChC,SAAS;AAAA,YACT,WAAW;AAAA,YACX,UAAU,SAAS,YAAY;AAAA,YAC/B,gBAAgB,SAAS,kBAAkB;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO,QAAQ,IAAI,CAAC,QAAQ,UAAU;AACpC,YAAM,eAAe,YAAY,KAAK,EAAE,MAAM,YAAY,KAAK,EAAE;AACjE,aAAO,OAAO,WAAW,aACrB,EAAE,cAAc,IAAI,OAAO,OAAO,OAAO,OAAO,IAChD,EAAE,cAAc,IAAI,KAAK;AAAA,IAC/B,CAAC;AAAA,EACH;AAQA,WAAS,GACP,OACA,SACA,SACM;AACN,QAAI,CAAC,UAAU,IAAI,KAAK,GAAG;AACzB,gBAAU,IAAI,OAAO,oBAAI,IAAI,CAAC;AAAA,IAChC;AACA,UAAM,aAAmC;AAAA,MACvC,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA;AAAA,MACA,YAAY,SAAS;AAAA,IACvB;AACA,cAAU,IAAI,KAAK,EAAG,IAAI,UAAU;AACpC,QAAI,SAAS,YAAY;AACvB,4BAAsB,IAAI,UAAU;AAAA,IACtC;AAAA,EACF;AAKA,WAAS,0BAA0B,MAAoC;AACrE,eAAW,OAAO,MAAM;AACtB,SAAG,IAAI,OAAO,IAAI,SAAS,EAAE,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,IAAI,IAAI,GAAG,CAAC;AAAA,IAC/F;AAAA,EACF;AAOA,iBAAe,KACb,OACA,SACA,SACe;AACf,UAAM,gBAAgB,YAA2B;AAC/C,YAAM,OAAO,mBAAmB;AAChC,iBAAW,OAAO,MAAM;AACtB,YAAI;AACF,gBAAM,QAAQ,QAAQ,IAAI,OAAO,SAAS,OAAO,CAAC;AAAA,QACpD,SAAS,OAAO;AACd,iBAAO,MAAM,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AASA,UAAM,0BAA0B,YAA2B;AACzD,YAAM,sBAAsB,+BAA+B,OAAO,SAAS,OAAO;AAClF,UACE,CAAC,0BAA0B,KAAK,KAC7B,CAAC,sBAAsB,mBAAmB,KAC1C,CAAC,kCAAkC,OAAO,qBAAqB,eAAe,EACjF;AACF,UAAI;AACF,cAAM,yBAAyB,OAAO,SAAS,mBAAmB;AAAA,MACpE,SAAS,OAAO;AACd,eAAO,MAAM,+BAA+B,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MACnE;AAAA,IACF;AAWA,UAAM,0BAA0B,0BAA0B,KAAK,KAC1D,mCAAmC,IAAI;AAC5C,QAAI,yBAAyB;AAC3B,YAAM;AAAA,QACJ,0BAA0B,OAAO,SAAS,OAAO;AAAA,QACjD,YAAY;AACV,gBAAM,cAAc;AACpB,gBAAM,wBAAwB;AAAA,QAChC;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,cAAc;AAAA,IACtB;AAWA,UAAM,cAAc,QAAQ,SAAS,UAAU,KAAK,SAAS,kBAAkB;AAE/E,UAAM,iBAAiB,wBAAwB;AAC/C,UAAM,uBAAuB,SAAS,oCAAoC,QACpE,QAAQ,SAAS,UAAU,KAAK;AACtC,QAAI,yBAAyB;AAC7B,QAAI,CAAC,aAAa;AAChB,YAAM,YAAY,MAAM,QAAQ,OAAO,SAAS,SAAS,oBAAoB;AAC7E,+BAAyB,UAAU,qBAAqB;AAAA,IAC1D;AAIA,QAAI,CAAC,yBAAyB;AAC5B,YAAM,wBAAwB;AAAA,IAChC;AAGA,QAAI,SAAS,YAAY;AACvB,YAAM,IAAI,SAAS;AACnB,YAAM,EAAE,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,2BAA2B,CAAC,eAAe,CAAC,wBAAwB,CAAC;AAAA,MACvE,CAAC;AAAA,IACH;AAAA,EACF;AAKA,iBAAe,aAA2C;AACxD,UAAM,IAAI,SAAS;AACnB,WAAO,EAAE,MAAM;AAAA,EACjB;AAGA,QAAM,YAAY;AAElB,SAAO;AAAA,IACL;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/events",
-  "version": "0.10.1-develop.7579.1.3db6f78f16",
+  "version": "0.10.1-develop.7581.1.b3eee6e717",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,8 +33,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/queue": "0.10.1-develop.7579.1.3db6f78f16",
-    "@open-mercato/shared": "0.10.1-develop.7579.1.3db6f78f16",
+    "@open-mercato/queue": "0.10.1-develop.7581.1.b3eee6e717",
+    "@open-mercato/shared": "0.10.1-develop.7581.1.b3eee6e717",
     "pg": "8.23.0"
   },
   "devDependencies": {

package/src/__tests__/bridge-oversize-envelope.test.ts

@@ -0,0 +1,162 @@
+const query = jest.fn(async () => undefined)
+const warn = jest.fn()
+
+jest.mock('pg', () => ({
+  Client: jest.fn(),
+  Pool: jest.fn(() => ({ query })),
+}))
+
+jest.mock('@open-mercato/shared/lib/db/ssl', () => ({
+  getSslConfig: jest.fn(() => null),
+}))
+
+jest.mock('@open-mercato/shared/lib/logger', () => {
+  const createMockLogger = (): Record<string, unknown> => {
+    const mockLogger: Record<string, unknown> = {
+      error: jest.fn(),
+      warn: (...args: unknown[]) => warn(...args),
+      info: jest.fn(),
+      debug: jest.fn(),
+    }
+    mockLogger.child = () => mockLogger
+    return mockLogger
+  }
+  return { createLogger: jest.fn(() => createMockLogger()) }
+})
+
+import { createModuleEvents } from '@open-mercato/shared/modules/events'
+import { publishCrossProcessEvent } from '../bridge'
+
+createModuleEvents({
+  moduleId: 'bridge_oversize_test',
+  events: [
+    { id: 'bridge_oversize_test.portal', label: 'Portal', portalBroadcast: true },
+    { id: 'bridge_oversize_test.browser', label: 'Browser', clientBroadcast: true },
+    { id: 'bridge_oversize_test.private', label: 'Private', crossProcessBroadcast: true },
+  ] as const,
+})
+
+type SerializedEnvelope = {
+  event: string
+  payload: Record<string, unknown>
+  options?: Record<string, unknown>
+}
+
+function lastPublishedEnvelope(): SerializedEnvelope {
+  const serialized = query.mock.calls.at(-1)?.[1]?.[1]
+  expect(typeof serialized).toBe('string')
+  return JSON.parse(serialized as string) as SerializedEnvelope
+}
+
+const oversizeBody = 'x'.repeat(10_000)
+
+describe('cross-process bridge oversize envelopes', () => {
+  const originalDatabaseUrl = process.env.DATABASE_URL
+
+  beforeAll(() => {
+    process.env.DATABASE_URL = 'postgres://postgres:postgres@localhost:5432/mercato'
+  })
+
+  afterAll(() => {
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL
+    else process.env.DATABASE_URL = originalDatabaseUrl
+  })
+
+  beforeEach(() => {
+    query.mockClear()
+    warn.mockClear()
+  })
+
+  it('publishes envelopes within the limit unchanged', async () => {
+    const payload = { id: 'ticket-1', tenantId: 'tenant-1', body: 'short' }
+
+    await publishCrossProcessEvent('bridge_oversize_test.portal', payload, { tenantId: 'tenant-1' })
+
+    expect(lastPublishedEnvelope().payload).toEqual(payload)
+    expect(warn).not.toHaveBeenCalled()
+  })
+
+  it('truncates an oversize portal envelope to an entity ref that keeps the audience scope', async () => {
+    const options = { tenantId: 'tenant-1', organizationId: 'org-1' }
+
+    await publishCrossProcessEvent(
+      'bridge_oversize_test.portal',
+      {
+        id: ' ticket-1 ',
+        entityType: 'staff:support_ticket',
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+        organizationIds: ['org-1', 42, ''],
+        recipientUserId: 'customer-1',
+        recipientUserIds: ['customer-1', 'customer-2'],
+        recipientRoleIds: ['role-1'],
+        body: oversizeBody,
+      },
+      options,
+    )
+
+    expect(query).toHaveBeenCalledTimes(1)
+    const envelope = lastPublishedEnvelope()
+    expect(envelope.event).toBe('bridge_oversize_test.portal')
+    expect(envelope.options).toEqual(options)
+    expect(envelope.payload).toEqual({
+      truncated: true,
+      id: 'ticket-1',
+      entityType: 'staff:support_ticket',
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+      organizationIds: ['org-1'],
+      recipientUserId: 'customer-1',
+      recipientUserIds: ['customer-1', 'customer-2'],
+      recipientRoleIds: ['role-1'],
+    })
+    expect(warn).toHaveBeenCalledWith(
+      'Cross-process event truncated: payload exceeds size limit',
+      expect.objectContaining({ event: 'bridge_oversize_test.portal' }),
+    )
+  })
+
+  it('truncates an oversize clientBroadcast envelope the same way', async () => {
+    await publishCrossProcessEvent(
+      'bridge_oversize_test.browser',
+      { entityId: 'record-1', tenantId: 'tenant-1', body: oversizeBody },
+      { tenantId: 'tenant-1' },
+    )
+
+    expect(lastPublishedEnvelope().payload).toEqual({
+      truncated: true,
+      entityId: 'record-1',
+      tenantId: 'tenant-1',
+    })
+  })
+
+  it('drops an oversize private crossProcessBroadcast envelope instead of reshaping it', async () => {
+    await publishCrossProcessEvent(
+      'bridge_oversize_test.private',
+      { id: 'record-1', tenantId: 'tenant-1', body: oversizeBody },
+      { tenantId: 'tenant-1', emitterModuleId: 'bridge_oversize_test' },
+    )
+
+    expect(query).not.toHaveBeenCalled()
+    expect(warn).toHaveBeenCalledWith(
+      'Cross-process event dropped: payload exceeds size limit',
+      expect.objectContaining({ event: 'bridge_oversize_test.private' }),
+    )
+  })
+
+  it('drops an envelope that still exceeds the limit after truncation', async () => {
+    const recipientUserIds = Array.from({ length: 600 }, (entry, index) => `customer-${index}`)
+
+    await publishCrossProcessEvent(
+      'bridge_oversize_test.portal',
+      { id: 'ticket-1', tenantId: 'tenant-1', recipientUserIds },
+      { tenantId: 'tenant-1' },
+    )
+
+    expect(query).not.toHaveBeenCalled()
+    expect(warn).toHaveBeenCalledWith(
+      'Cross-process event dropped: payload exceeds size limit',
+      expect.objectContaining({ event: 'bridge_oversize_test.portal' }),
+    )
+  })
+})

package/src/__tests__/bridge-scope-serialization.test.ts

@@ -9,12 +9,19 @@ jest.mock('@open-mercato/shared/lib/db/ssl', () => ({
   getSslConfig: jest.fn(() => null),
 }))
 
-jest.mock('@open-mercato/shared/lib/logger', () => ({
-  createLogger: jest.fn(() => ({
-    error: jest.fn(),
-    warn: jest.fn(),
-  })),
-}))
+jest.mock('@open-mercato/shared/lib/logger', () => {
+  const createMockLogger = (): Record<string, unknown> => {
+    const mockLogger: Record<string, unknown> = {
+      error: jest.fn(),
+      warn: jest.fn(),
+      info: jest.fn(),
+      debug: jest.fn(),
+    }
+    mockLogger.child = () => mockLogger
+    return mockLogger
+  }
+  return { createLogger: jest.fn(() => createMockLogger()) }
+})
 
 import { publishCrossProcessEvent } from '../bridge'
 

package/src/__tests__/cross-process-broadcast.test.ts

@@ -14,6 +14,8 @@ const testEventsConfig = createModuleEvents({
   events: [
     { id: 'cross_process_test.browser', label: 'Browser', clientBroadcast: true },
     { id: 'cross_process_test.private', label: 'Private', crossProcessBroadcast: true },
+    { id: 'cross_process_test.portal', label: 'Portal', portalBroadcast: true },
+    { id: 'cross_process_test.portal_private', label: 'Portal private', portalBroadcast: true, crossProcessBroadcast: true },
     { id: 'cross_process_test.local', label: 'Local' },
   ] as const,
 })
@@ -167,4 +169,93 @@ describe('cross-process event publication', () => {
 
     expect(publishCrossProcessEventMock).not.toHaveBeenCalled()
   })
+  describe('portalBroadcast-only events', () => {
+    it('publishes a portal-only event cross-process with trusted options scope', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+      const trustedScope = { tenantId: 'tenant-1', organizationId: 'org-1' }
+      const payload = { id: 'ticket-1', tenantId: 'tenant-1', organizationId: 'org-1' }
+
+      await bus.emit('cross_process_test.portal', payload, trustedScope)
+
+      expect(publishCrossProcessEventMock).toHaveBeenCalledTimes(1)
+      expect(publishCrossProcessEventMock).toHaveBeenCalledWith('cross_process_test.portal', payload, trustedScope)
+    })
+
+    it('promotes typed payload scope for raw portal-only emits, like legacy clientBroadcast', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+      const payload = {
+        id: 'ticket-1',
+        tenantId: ' tenant-1 ',
+        organizationId: ' org-1 ',
+        recipientUserId: 'customer-1',
+      }
+
+      await bus.emit('cross_process_test.portal', payload)
+
+      expect(publishCrossProcessEventMock).toHaveBeenCalledWith(
+        'cross_process_test.portal',
+        payload,
+        { tenantId: 'tenant-1', organizationId: 'org-1' },
+      )
+    })
+
+    it('publishes portal-only events emitted through the module emitter (e.g. from a worker subscriber)', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+      setGlobalEventBus(bus)
+      const payload = { id: 'ticket-1', tenantId: 'tenant-1', organizationId: 'org-1' }
+
+      await testEventsConfig.emit('cross_process_test.portal', payload)
+
+      expect(publishCrossProcessEventMock).toHaveBeenCalledWith(
+        'cross_process_test.portal',
+        payload,
+        { tenantId: 'tenant-1', organizationId: 'org-1' },
+      )
+    })
+
+    it('prefers trusted options over a forged portal payload scope', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+      const trustedScope = { tenantId: 'workflow-tenant', organizationId: 'workflow-org' }
+      const payload = { id: 'ticket-1', tenantId: 'forged-tenant', organizationId: 'forged-org' }
+
+      await bus.emit('cross_process_test.portal', payload, trustedScope)
+
+      expect(publishCrossProcessEventMock).toHaveBeenCalledWith('cross_process_test.portal', payload, trustedScope)
+    })
+
+    it('does not publish a portal-only event without tenant scope', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+
+      await bus.emit('cross_process_test.portal', { id: 'ticket-1', organizationId: 'org-1' })
+      await bus.emit('cross_process_test.portal', { id: 'ticket-1', tenantId: '   ' }, { organizationId: 'org-1' })
+
+      expect(publishCrossProcessEventMock).not.toHaveBeenCalled()
+    })
+
+    it('treats a portal + crossProcessBroadcast event as private: no payload-scope promotion, no foreign emitter', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+
+      await bus.emit('cross_process_test.portal_private', {
+        id: 'ticket-1',
+        tenantId: 'payload-tenant',
+        organizationId: 'payload-org',
+      })
+      await bus.emit('cross_process_test.portal_private', { id: 'ticket-1' }, {
+        tenantId: 'tenant-1',
+        emitterModuleId: 'workflows',
+      })
+
+      expect(publishCrossProcessEventMock).not.toHaveBeenCalled()
+    })
+
+    it('does not publish undeclared or local-only events', async () => {
+      const bus = createEventBus({ resolve, queueStrategy: 'local' })
+      const payload = { id: 'record-1', tenantId: 'tenant-1' }
+
+      await bus.emit('cross_process_test.local', payload, { tenantId: 'tenant-1' })
+      await bus.emit('cross_process_test.undeclared', payload, { tenantId: 'tenant-1' })
+
+      expect(publishCrossProcessEventMock).not.toHaveBeenCalled()
+    })
+  })
 })

package/src/bridge.ts

@@ -2,11 +2,15 @@ import { randomUUID } from 'node:crypto'
 import { Client, Pool } from 'pg'
 import { getSslConfig } from '@open-mercato/shared/lib/db/ssl'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'
 import type { EmitOptions, EventPayload } from './types'
 
 const BRIDGE_CHANNEL = 'om_event_bridge'
 const MAX_MESSAGE_BYTES = 7_000
 const RECONNECT_DELAY_MS = 1_000
+const TRUNCATED_ENTITY_REF_KEYS = ['id', 'entityId', 'entityType'] as const
+const TRUNCATED_AUDIENCE_SCALAR_KEYS = ['tenantId', 'organizationId', 'recipientUserId', 'recipientRoleId'] as const
+const TRUNCATED_AUDIENCE_LIST_KEYS = ['organizationIds', 'recipientUserIds', 'recipientRoleIds'] as const
 const CROSS_PROCESS_EVENT_INSTANCE_ID_KEY = '__openMercatoCrossProcessEventInstanceId__'
 
 const logger = createLogger('events')
@@ -192,8 +196,8 @@ export async function publishCrossProcessEvent(
     originInstanceId: CROSS_PROCESS_EVENT_INSTANCE_ID,
   }
 
-  const serialized = JSON.stringify(envelope)
-  if (Buffer.byteLength(serialized, 'utf8') > MAX_MESSAGE_BYTES) {
+  const serialized = serializeWithinLimit(envelope)
+  if (!serialized) {
     logger.warn('Cross-process event dropped: payload exceeds size limit', { event, maxBytes: MAX_MESSAGE_BYTES })
     return
   }
@@ -201,6 +205,40 @@ export async function publishCrossProcessEvent(
   await pool.query('SELECT pg_notify($1, $2)', [BRIDGE_CHANNEL, serialized])
 }
 
+function fitsMessageLimit(serialized: string): boolean {
+  return Buffer.byteLength(serialized, 'utf8') <= MAX_MESSAGE_BYTES
+}
+
+/** Oversize browser-facing envelopes degrade to a scoped entity ref; private coordination is never reshaped, only dropped. */
+function serializeWithinLimit(envelope: BridgeEnvelope): string | null {
+  const serialized = JSON.stringify(envelope)
+  if (fitsMessageLimit(serialized)) return serialized
+  if (isPrivateCrossProcessBroadcastEvent(envelope.event)) return null
+  const truncated = JSON.stringify({ ...envelope, payload: buildTruncatedPayload(envelope.payload) })
+  if (!fitsMessageLimit(truncated)) return null
+  logger.warn('Cross-process event truncated: payload exceeds size limit', {
+    event: envelope.event,
+    maxBytes: MAX_MESSAGE_BYTES,
+  })
+  return truncated
+}
+
+function buildTruncatedPayload(payload: EventPayload): EventPayload {
+  const source = (payload ?? {}) as Record<string, unknown>
+  const truncated: Record<string, unknown> = { truncated: true }
+  for (const key of [...TRUNCATED_ENTITY_REF_KEYS, ...TRUNCATED_AUDIENCE_SCALAR_KEYS]) {
+    const value = source[key]
+    if (typeof value === 'string' && value.trim().length > 0) truncated[key] = value.trim()
+  }
+  for (const key of TRUNCATED_AUDIENCE_LIST_KEYS) {
+    const value = source[key]
+    if (!Array.isArray(value)) continue
+    const scopes = value.filter((entry): entry is string => typeof entry === 'string' && entry.trim().length > 0)
+    if (scopes.length > 0) truncated[key] = scopes
+  }
+  return truncated
+}
+
 export function registerCrossProcessEventListener(listener: CrossProcessEventListener): () => void {
   listeners.add(listener)
   void ensureCrossProcessListener()

package/src/bus.ts

@@ -9,6 +9,8 @@ import {
   isBroadcastEvent,
   isCoalescedBroadcastEvent,
   isCrossProcessBroadcastEvent,
+  isPortalBroadcastEvent,
+  isPrivateCrossProcessBroadcastEvent,
   isPrivateCrossProcessEventEmitter,
 } from '@open-mercato/shared/modules/events'
 import {
@@ -76,17 +78,27 @@ function normalizePayloadScope(value: unknown): string | null {
   return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
 }
 
+function isBrowserBroadcastEvent(event: string): boolean {
+  return isBroadcastEvent(event) || isPortalBroadcastEvent(event)
+}
+
+/** Relayed over the bridge: both browser audiences plus private coordination; each consumer filters by its own flag. */
+function shouldPublishCrossProcess(event: string): boolean {
+  return isCrossProcessBroadcastEvent(event) || isPortalBroadcastEvent(event)
+}
+
 function resolveCrossProcessEmitOptions(
   event: string,
   payload: EventPayload,
   options?: EmitOptions,
 ): EmitOptions | undefined {
   if (hasTrustedTenantScope(options)) return options
-  // Preserve the public raw EventBus contract for legacy clientBroadcast
-  // emitters. These callers are trusted server code and historically supplied
-  // their scope in the typed payload. Tenant-managed workflow execution passes
-  // scope in options, while private cross-process events never take this path.
-  if (!isBroadcastEvent(event)) return options
+  // Preserve the public raw EventBus contract for legacy clientBroadcast and
+  // portalBroadcast emitters. These callers are trusted server code and
+  // historically supplied their scope in the typed payload. Tenant-managed
+  // workflow execution passes scope in options, while private cross-process
+  // events never take this path.
+  if (!isBrowserBroadcastEvent(event) || isPrivateCrossProcessBroadcastEvent(event)) return options
   const tenantId = normalizePayloadScope((payload as Record<string, unknown>)?.tenantId)
   if (!tenantId) return options
   const organizationId = normalizePayloadScope((payload as Record<string, unknown>)?.organizationId)
@@ -605,7 +617,7 @@ export function createEventBus(opts: CreateBusOptions): EventBus {
     const publishToOtherProcesses = async (): Promise<void> => {
       const crossProcessOptions = resolveCrossProcessEmitOptions(event, payload, options)
       if (
-        !isCrossProcessBroadcastEvent(event)
+        !shouldPublishCrossProcess(event)
         || !hasTrustedTenantScope(crossProcessOptions)
         || !isPrivateCrossProcessEventEmitter(event, crossProcessOptions?.emitterModuleId)
       ) return